Play interactive tourEdit tour

Windows Analysis Report
https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwE

Overview

General Information

Sample URL:	https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwE
Analysis ID:	1586194
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

AI detected landing page (webpage, office document or email)

Blob-based file download detected

Creates multiple autostart registry keys

Found strings related to Crypto-Mining

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

Installs a global mouse hook

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

Queries keyboard layouts

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Too many similar processes found

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

×

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\PCAppStore\PCAppStore.exe" /init default, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp, ProcessId: 7564, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PCAppStore

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	ReversingLabs: Detection: 34%
Source: C:\Users\user\PCAppStore\Uninstaller.exe	ReversingLabs: Detection: 26%

Phishing

AI detected landing page (webpage, office document or email)

Source: https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwE

Joe Sandbox AI: Page contains button: 'DOWNLOAD NOW' Source: '1.0.pages.csv'

HTML page is missing a favicon

Source: https://pcapp.store/?p=lpd_installing_r2&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&_fcid=1736363911229592&_winver=19045&version=fa.2002	HTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&_fcid=1736363911229592&_winver=19045&version=fa.2002	HTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&_fcid=1736363911229592&_winver=19045&version=fa.2002	HTTP Parser: No favicon

Bitcoin Miner

Found strings related to Crypto-Mining

Source: msedgewebview2.exe, 00000014.00000003.1536638513.0000191400D0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: jsecoin.com
Source: msedgewebview2.exe, 00000014.00000002.1618634109.0000191400D4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "coinhive.com

Compliance

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCAppStore

Jump to behavior

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp

File created: C:\Users\user\PCAppStore\ReadMe.txt

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.150.255.184:443 -> 192.168.2.18:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.205.91:443 -> 192.168.2.18:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.10:443 -> 192.168.2.18:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.113.200.164:443 -> 192.168.2.18:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.118:443 -> 192.168.2.18:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49932 version: TLS 1.2

Binary contains paths to debug symbols

Source:	Binary string: C:\Build\Build_2002_D20241129T170824\fa_rss\AppStoreUpdater\Release\auto_updater.pdb source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Build\Build_2002_D20241129T170824\fa_rss\AppStoreUpdater\Release\auto_updater.pdb1 source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Build\Build_2002_D20241129T170824\fa_rss\Watchdog\x64\Release\Watchdog.pdb source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000000.1508438820.00007FF60C90A000.00000002.00000001.01000000.00000015.sdmp, Watchdog.exe.16.dr
Source:	Binary string: C:\Users\zak\Downloads\Inetc\Unicode\Plugins\inetc.pdb source: Setup.exe, 00000009.00000002.1468089871.000000000040A000.00000004.00000001.01000000.00000004.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, inetc.dll.16.dr, inetc.dll.9.dr
Source:	Binary string: C:\Build\Build_2002_D20241129T170824\fa_rss\engine\Release\PCAppStore.pdb source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1507947709.00007FF7D4A99000.00000002.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr

Networking

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /api/pcapp_engine.php?a=config&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002 HTTP/1.1Host: pcapp.storeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/pcapp_engine.php?a=config&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002 HTTP/1.1Host: pcapp.storeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/pcapp_engine.php?a=config&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002 HTTP/1.1Host: pcapp.storeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/pcapp_engine.php?a=config&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002 HTTP/1.1Host: pcapp.storeCache-Control: no-cache

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49817 -> 104.248.126.225:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49822 -> 104.248.126.225:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49830 -> 104.248.126.225:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49857 -> 104.248.126.225:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49865 -> 104.248.126.225:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49886 -> 104.248.126.225:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49895 -> 104.248.126.225:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49938 -> 104.248.126.225:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49932 -> 104.248.126.225:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.18:49819 -> 104.248.126.225:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.18:49854 -> 104.248.126.225:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.18:49883 -> 104.248.126.225:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.18:49930 -> 104.248.126.225:443

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.42.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.113.200.164
Source: unknown	TCP traffic detected without corresponding DNS query: 20.113.200.164
Source: unknown	TCP traffic detected without corresponding DNS query: 20.113.200.164
Source: unknown	TCP traffic detected without corresponding DNS query: 20.113.200.164
Source: unknown	TCP traffic detected without corresponding DNS query: 20.113.200.164
Source: unknown	TCP traffic detected without corresponding DNS query: 20.113.200.164
Source: unknown	TCP traffic detected without corresponding DNS query: 20.113.200.164

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwE HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_farss_sd_r1/src/lp26_farss_sd_r1.min.css?nocache=1724662836855 HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_farss_sd_r1/img/fast_laptop.png HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /src/main.js HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /src/download_file.js HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_farss_sd_r1/src/lp26_farss_sd_r1.js?nocache=1706111333446 HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_farss_sd_r1/img/fast_logo_text.png HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_farss_sd_r1/img/calendar.svg HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_farss_sd_r1/img/clock.svg HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /src/main.js HTTP/1.1Host: veryfast.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /src/download_file.js HTTP/1.1Host: veryfast.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_farss_sd_r1/src/lp26_farss_sd_r1.js?nocache=1706111333446 HTTP/1.1Host: veryfast.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_farss_sd_r1/img/fast_logo_text.png HTTP/1.1Host: veryfast.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_farss_sd_r1/img/rocket.svg HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_farss_sd_r1/img/fast_logo_text.png HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_rarss_sd_r1/img/icon_download_cloud_white.svg HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://veryfast.io/lp/lpd/lp26_farss_sd_r1/src/lp26_farss_sd_r1.min.css?nocache=1724662836855Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_rarss_sd_r3/img/gear-list-item.png HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://veryfast.io/lp/lpd/lp26_farss_sd_r1/src/lp26_farss_sd_r1.min.css?nocache=1724662836855Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_farss_sd_r1/img/clock.svg HTTP/1.1Host: veryfast.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_farss_sd_r1/img/calendar.svg HTTP/1.1Host: veryfast.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /pixelgif.php HTTP/1.1Host: veryfast.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_farss_sd_r1/img/rocket.svg HTTP/1.1Host: veryfast.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_farss_sd_r1/img/fast_logo_text.png HTTP/1.1Host: veryfast.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_rarss_sd_r1/img/icon_download_cloud_white.svg HTTP/1.1Host: veryfast.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/global/favicon.ico HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/lpd/lp26_rarss_sd_r3/img/gear-list-item.png HTTP/1.1Host: veryfast.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /lp/global/favicon.ico HTTP/1.1Host: veryfast.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /download.php?link=1&drm=1&version=last&entry_app=fast HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/json;charset=UTF-8Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /pixel.gif?evt_src=lp_behavior&evt_action=dl_click&position=main&_fcid=1736363911229592&ncrd=1736363915239&user-agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/117.0.0.0%20Safari/537.36 HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /pixel.gif?evt_src=lp_behavior&evt_action=dl_click&position=main&_fcid=1736363911229592&ncrd=1736363915239&user-agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/117.0.0.0%20Safari/537.36 HTTP/1.1Host: veryfast.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /download.php?link=1&drm=1&version=last&entry_app=fast HTTP/1.1Host: veryfast.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /download/fa/drm/m.fa.2002.drm HTTP/1.1Host: repcdn.pcapp.storeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://veryfast.ioSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://veryfast.io/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pixel.gif?evt_src=downloading&evt_action=link&link=https://repcdn.pcapp.store/download/fa/drm/m.fa.2002.drm&fileSize=205424&drm=true&_fcid=1736363911229592&ncrd=1736363917300&user-agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/117.0.0.0%20Safari/537.36 HTTP/1.1Host: veryfast.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /download/fa/drm/m.fa.2002.drm HTTP/1.1Host: repcdn.pcapp.storeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pixel.gif?evt_src=downloading&evt_action=link&link=https://repcdn.pcapp.store/download/fa/drm/m.fa.2002.drm&fileSize=205424&drm=true&_fcid=1736363911229592&ncrd=1736363917300&user-agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/117.0.0.0%20Safari/537.36 HTTP/1.1Host: veryfast.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /api/api.php HTTP/1.1Host: veryfast.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html
Source: global traffic	HTTP traffic detected: GET /pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_mini_installer&evt_action=show_page&p=wel&_fcid=1736363911229592 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: pcapp.storeConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_mini_installer&evt_action=show_page&p=installing&_fcid=1736363911229592 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: pcapp.storeConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_mini_installer&evt_action=start&permision=&_fcid=1736363911229592 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: pcapp.storeConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /installing.php?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&winver=19045&version=fa.2002&nocache=20250108141848.112&_fcid=1736363911229592 HTTP/1.1Host: pcapp.storeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?p=lpd_installing_r2&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&_fcid=1736363911229592&_winver=19045&version=fa.2002 HTTP/1.1Host: pcapp.storeConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_mini_installer&evt_action=download_start&_fcid=1736363911229592 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: pcapp.storeConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lp/lpd_installing_r2/src/lpd_installing_r2.min.css?nocache=1731594251558 HTTP/1.1Host: pcapp.storeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://pcapp.store/?p=lpd_installing_r2&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&_fcid=1736363911229592&_winver=19045&version=fa.2002Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/front_img/lp/lpd_installing_r2/img/done_windows_icon.svg HTTP/1.1Host: pcapp.storeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pcapp.store/?p=lpd_installing_r2&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&_fcid=1736363911229592&_winver=19045&version=fa.2002Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /src/main.js HTTP/1.1Host: pcapp.storeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pcapp.store/?p=lpd_installing_r2&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&_fcid=1736363911229592&_winver=19045&version=fa.2002Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lp/lpd_installing_r2/src/lpd_installing_r2.min.js?nocache=1731594251558 HTTP/1.1Host: pcapp.storeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pcapp.store/?p=lpd_installing_r2&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&_fcid=1736363911229592&_winver=19045&version=fa.2002Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/front_img/logo/logo-dark.svg HTTP/1.1Host: pcapp.storeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pcapp.store/?p=lpd_installing_r2&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&_fcid=1736363911229592&_winver=19045&version=fa.2002Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /src/main.js HTTP/1.1Host: pcapp.storeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /download.php?&src=mini_installer&file=1&mini_ver=fa.2002 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: delivery.pcapp.storeConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /pcapp/images/front_img/lp/lpd_installing_r2/img/done_windows_icon.svg HTTP/1.1Host: repository.pcapp.storeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pcapp.store/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pcapp/images/front_img/logo/logo-dark.svg HTTP/1.1Host: repository.pcapp.storeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pcapp.store/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lp/lpd_installing_r2/src/lpd_installing_r2.min.js?nocache=1731594251558 HTTP/1.1Host: pcapp.storeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/front_img/lp/lpd_installing_r2/img/done_cursor_icon.svg HTTP/1.1Host: pcapp.storeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pcapp.store/lp/lpd_installing_r2/src/lpd_installing_r2.min.css?nocache=1731594251558Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED
Source: global traffic	HTTP traffic detected: GET /pixelgif.php HTTP/1.1Host: pcapp.storeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED; _gcl_au=1.1.1310816872.1736363931
Source: global traffic	HTTP traffic detected: GET /api/api.php HTTP/1.1Host: pcapp.storeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED; _gcl_au=1.1.1310816872.1736363931
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/858128210/?random=1736363930557&cv=11&fst=1736363930557&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D56BB2742-D4AD-D40B-0E05-59D15B59EFED%26_fcid%3D1736363911229592%26_winver%3D19045%26version%3Dfa.2002&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1310816872.1736363931&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCOvUygEI/IPLAQiTocsBCIWgzQEI6cXNAQi5ys0BCInTzQEYwcvMARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pcapp.store/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/858128210/?random=1736363930593&cv=11&fst=1736363930593&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D56BB2742-D4AD-D40B-0E05-59D15B59EFED%26_fcid%3D1736363911229592%26_winver%3D19045%26version%3Dfa.2002&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1310816872.1736363931&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCOvUygEI/IPLAQiTocsBCIWgzQEI6cXNAQi5ys0BCInTzQEYwcvMARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pcapp.store/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/rul/858128210?random=1736363930557&cv=11&fst=1736363930557&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D56BB2742-D4AD-D40B-0E05-59D15B59EFED%26_fcid%3D1736363911229592%26_winver%3D19045%26version%3Dfa.2002&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1310816872.1736363931&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCOvUygEI/IPLAQiTocsBCIWgzQEI6cXNAQi5ys0BCInTzQEYwcvMARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://pcapp.store/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/rul/858128210?random=1736363930593&cv=11&fst=1736363930593&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D56BB2742-D4AD-D40B-0E05-59D15B59EFED%26_fcid%3D1736363911229592%26_winver%3D19045%26version%3Dfa.2002&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1310816872.1736363931&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCOvUygEI/IPLAQiTocsBCIWgzQEI6cXNAQi5ys0BCInTzQEYwcvMARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://pcapp.store/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pcapp/images/front_img/lp/lpd_installing_r2/img/done_windows_icon.svg HTTP/1.1Host: repository.pcapp.storeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED; _gcl_au=1.1.1310816872.1736363931
Source: global traffic	HTTP traffic detected: GET /td/ga/rul?tid=G-VFQWFX3X1C&gacid=1814460329.1736363931&gtm=45je4cc1v898645365za200zb9103256652&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178~102262856&z=202431492 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIu2yQEIprbJAQipncoBCOvUygEI/IPLAQiTocsBCIWgzQEI6cXNAQi5ys0BCInTzQEYwcvMARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://pcapp.store/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pcapp/images/front_img/logo/logo-dark.svg HTTP/1.1Host: repository.pcapp.storeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED; _gcl_au=1.1.1310816872.1736363931
Source: global traffic	HTTP traffic detected: GET /pcapp/images/front_img/lp/lpd_installing_r2/img/done_cursor_icon.svg HTTP/1.1Host: repository.pcapp.storeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pcapp.store/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED; _gcl_au=1.1.1310816872.1736363931; _ga_VFQWFX3X1C=GS1.1.1736363930.1.0.1736363930.60.0.0; _ga=GA1.1.1814460329.1736363931
Source: global traffic	HTTP traffic detected: GET /api/api.php HTTP/1.1Host: pcapp.storeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED; _gcl_au=1.1.1310816872.1736363931
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/858128210/?random=1736363930557&cv=11&fst=1736362800000&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D56BB2742-D4AD-D40B-0E05-59D15B59EFED%26_fcid%3D1736363911229592%26_winver%3D19045%26version%3Dfa.2002&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1310816872.1736363931&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7ddbrC3E79hhSa6XqD-ybawXpB5t7g8w&random=536868641&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCOvUygEI/IPLAQiTocsBCIWgzQEI6cXNAQi5ys0BCInTzQEYwcvMARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pcapp.store/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/858128210/?random=1736363930593&cv=11&fst=1736362800000&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D56BB2742-D4AD-D40B-0E05-59D15B59EFED%26_fcid%3D1736363911229592%26_winver%3D19045%26version%3Dfa.2002&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1310816872.1736363931&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7dm8S2p07c7YZfqDOqQudjgd2GP57b1Q&random=3983566412&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCOvUygEI/IPLAQiTocsBCIWgzQEI6cXNAQi5ys0BCInTzQEYwcvMARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pcapp.store/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/858128210/?random=1736363930557&cv=11&fst=1736363930557&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D56BB2742-D4AD-D40B-0E05-59D15B59EFED%26_fcid%3D1736363911229592%26_winver%3D19045%26version%3Dfa.2002&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1310816872.1736363931&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCOvUygEI/IPLAQiTocsBCIWgzQEI6cXNAQi5ys0BCInTzQEYwcvMARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/858128210/?random=1736363930593&cv=11&fst=1736363930593&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D56BB2742-D4AD-D40B-0E05-59D15B59EFED%26_fcid%3D1736363911229592%26_winver%3D19045%26version%3Dfa.2002&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1310816872.1736363931&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCOvUygEI/IPLAQiTocsBCIWgzQEI6cXNAQi5ys0BCInTzQEYwcvMARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_mini_installer&evt_action=download_done&result=12345678-1234-5678-90AB-CDDEEFAABBCC&_fcid=1736363911229592 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: pcapp.storeConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /pcapp/images/front_img/lp/lpd_installing_r2/img/done_cursor_icon.svg HTTP/1.1Host: repository.pcapp.storeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED; _gcl_au=1.1.1310816872.1736363931; _ga=GA1.1.1814460329.1736363931; _ga_VFQWFX3X1C=GS1.1.1736363930.1.0.1736363930.60.0.0
Source: global traffic	HTTP traffic detected: GET /lp/appstore/img/favicon.ico HTTP/1.1Host: pcapp.storeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pcapp.store/?p=lpd_installing_r2&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&_fcid=1736363911229592&_winver=19045&version=fa.2002Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED; _gcl_au=1.1.1310816872.1736363931; _ga=GA1.1.1814460329.1736363931; _ga_VFQWFX3X1C=GS1.1.1736363930.1.0.1736363930.60.0.0
Source: global traffic	HTTP traffic detected: GET /pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_mini_installer&evt_action=done&_fcid=1736363911229592 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: pcapp.storeConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/858128210/?random=1736363930557&cv=11&fst=1736362800000&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D56BB2742-D4AD-D40B-0E05-59D15B59EFED%26_fcid%3D1736363911229592%26_winver%3D19045%26version%3Dfa.2002&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1310816872.1736363931&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7ddbrC3E79hhSa6XqD-ybawXpB5t7g8w&random=536868641&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCOvUygEI/IPLAQiTocsBCIWgzQEI6cXNAQi5ys0BCInTzQEYwcvMARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/858128210/?random=1736363930593&cv=11&fst=1736362800000&bg=ffffff&guid=ON&async=1&gtm=45be4cc1v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D56BB2742-D4AD-D40B-0E05-59D15B59EFED%26_fcid%3D1736363911229592%26_winver%3D19045%26version%3Dfa.2002&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1310816872.1736363931&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCa7L7dm8S2p07c7YZfqDOqQudjgd2GP57b1Q&random=3983566412&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCOvUygEI/IPLAQiTocsBCIWgzQEI6cXNAQi5ys0BCInTzQEYwcvMARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_installer&evt_action=internal&prev_v=fa.2002 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: pcapp.storeConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lp/appstore/img/favicon.ico HTTP/1.1Host: pcapp.storeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED; _gcl_au=1.1.1310816872.1736363931; _ga=GA1.1.1814460329.1736363931; _ga_VFQWFX3X1C=GS1.1.1736363930.1.0.1736363930.60.0.0
Source: global traffic	HTTP traffic detected: GET /pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_installer&evt_action=start&permision= HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: pcapp.storeConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_installer&evt_action=installing&e=03000200-0400-0500-0006-000700080009&u=66 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: pcapp.storeConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_installer&evt_action=localmac&addon[]=EC-F4-BB-FF-25-8C HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: pcapp.storeConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/api.php HTTP/1.1Host: pcapp.storeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED; _gcl_au=1.1.1310816872.1736363931; _ga=GA1.1.1814460329.1736363931; _ga_VFQWFX3X1C=GS1.1.1736363930.1.0.1736363930.60.0.0
Source: global traffic	HTTP traffic detected: GET /pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&inst_parent=&evt_src=fa_installer&evt_action=done HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: pcapp.storeConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_product&evt_action=channel&id=-3&eng_time=1736369490816&nocache=5704156 HTTP/1.1Connection: Keep-AliveUser-Agent: WinHTTP 1.0Host: pcapp.store
Source: global traffic	HTTP traffic detected: GET /api/pcapp_engine.php?a=config&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002 HTTP/1.1Host: pcapp.storeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":0,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736369490&nocache=26548 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":1,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736371409&nocache=29683 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_product&evt_action=started&prnt=nsnE8D9.tmp&sys_lang=en-GB&eng_time=1736369490851&nocache=5705828 HTTP/1.1Connection: Keep-AliveUser-Agent: WinHTTP 1.0Host: pcapp.store
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":2,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736373208&nocache=32622 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/api.php HTTP/1.1Host: pcapp.storeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED; _gcl_au=1.1.1310816872.1736363931; _ga=GA1.1.1814460329.1736363931; _ga_VFQWFX3X1C=GS1.1.1736363930.1.0.1736363930.60.0.0
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":3,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736375127&nocache=2989 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":4,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736377045&nocache=6124 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":5,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736378964&nocache=9259 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":6,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736381123&nocache=12786 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/api.php HTTP/1.1Host: pcapp.storeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED; _gcl_au=1.1.1310816872.1736363931; _ga=GA1.1.1814460329.1736363931; _ga_VFQWFX3X1C=GS1.1.1736363930.1.0.1736363930.60.0.0
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":7,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736384001&nocache=17489 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":8,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736385919&nocache=20624 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":9,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736387838&nocache=23758 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/api.php HTTP/1.1Host: pcapp.storeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED; _gcl_au=1.1.1310816872.1736363931; _ga=GA1.1.1814460329.1736363931; _ga_VFQWFX3X1C=GS1.1.1736363930.1.0.1736363930.60.0.0
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":10,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736389637&nocache=26697 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":11,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736391795&nocache=30224 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":12,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736393834&nocache=787 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":13,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736395872&nocache=4118 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/api.php HTTP/1.1Host: pcapp.storeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED; _gcl_au=1.1.1310816872.1736363931; _ga=GA1.1.1814460329.1736363931; _ga_VFQWFX3X1C=GS1.1.1736363930.1.0.1736363930.60.0.0
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":14,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736397671&nocache=7060 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":15,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736399590&nocache=10195 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":16,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736401389&nocache=13134 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":17,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736403308&nocache=16269 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":18,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736405346&nocache=19600 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":19,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736407265&nocache=22735 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/pcapp_engine.php?a=config&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002 HTTP/1.1Host: pcapp.storeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":20,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736409064&nocache=25674 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_product&evt_action=channel&id=-3&eng_time=1736369516485&nocache=5730859 HTTP/1.1Connection: Keep-AliveUser-Agent: WinHTTP 1.0Host: pcapp.store
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":21,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736411102&nocache=29005 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":22,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736412901&nocache=31944 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":23,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736414940&nocache=2507 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":24,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736417218&nocache=6230 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":25,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736419137&nocache=9365 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":26,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736421056&nocache=12500 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":27,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736422975&nocache=15635 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":28,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736425013&nocache=18966 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":29,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736427172&nocache=22492 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":30,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736429330&nocache=26019 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":31,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736431489&nocache=29546 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":32,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736433768&nocache=501 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/pcapp_engine.php?a=config&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002 HTTP/1.1Host: pcapp.storeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_product&evt_action=channel&id=-3&eng_time=1736369532445&nocache=5746812 HTTP/1.1Connection: Keep-AliveUser-Agent: WinHTTP 1.0Host: pcapp.store
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":33,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736436167&nocache=4419 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":34,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736438805&nocache=8730 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?7d1a84b2cd1bb4555d8fa3a9a488cab2 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: bab52f0d162809214dba6e2ad4c590c2.clo.footprintdns.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":35,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736441204&nocache=12649 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?24c0a8db180cffcc29ab82f684421f10 HTTP/1.1Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: bab52f0d162809214dba6e2ad4c590c2.clo.footprintdns.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":36,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736444083&nocache=17351 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":37,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736447441&nocache=22837 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":38,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736450560&nocache=27932 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":39,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736453678&nocache=261 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":40,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736456797&nocache=5355 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":41,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736460996&nocache=12213 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":42,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736464834&nocache=18483 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?d89b11ab3d46ab4535567a5cd7ebc8a4 HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: 320c8499fb50e86fcc1b96e694cb982d.azr.footprintdns.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":43,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736468793&nocache=24949 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?352db93544d2d369397dce3d926e9f38 HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: 320c8499fb50e86fcc1b96e694cb982d.azr.footprintdns.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":44,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736472392&nocache=30827 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":45,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736477071&nocache=5700 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":46,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736482470&nocache=14521 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":47,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736487749&nocache=23142 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":48,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736493028&nocache=31763 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":49,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736498067&nocache=7228 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":50,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736504306&nocache=17416 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":51,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736514625&nocache=1499 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":52,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736524344&nocache=17369 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":53,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736534183&nocache=671 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":54,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736543782&nocache=16349 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":55,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736554102&nocache=432 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":56,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736563941&nocache=16502 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":57,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736573661&nocache=32376 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":58,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736583740&nocache=16069 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/pcapp_engine.php?a=config&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002 HTTP/1.1Host: pcapp.storeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_product&evt_action=channel&id=-3&eng_time=1736369566262&nocache=5780640 HTTP/1.1Connection: Keep-AliveUser-Agent: WinHTTP 1.0Host: pcapp.store
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":59,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736593700&nocache=32335 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":60,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736608940&nocache=24457 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":61,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736618900&nocache=7955 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":62,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1736733020&nocache=30452 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":63,"rid":"20250108141857.2995704078","isPCAppRunning":1,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1738055301&nocache=26776 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":64,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1739736142&nocache=18725 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":65,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1741544783&nocache=22541 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":66,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1743266304&nocache=15573 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":67,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1744905985&nocache=5856 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":68,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1746630146&nocache=3001 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":69,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1748304988&nocache=17922 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":70,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1750400936&nocache=5813 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":71,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1752116697&nocache=22011 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":72,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1753814098&nocache=8231 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=watch_dog&evt_action=signal_event&data={"counter":73,"rid":"20250108141857.2995704078","isPCAppRunning":0,"registryInfo":{"pcAppInAutostart":1},"filesystemInfo":{"AutoUpdaterExeExists":1,"PcAppStoreExeExists":1,"pcappstoreIcoExists":1,"UninstallerExeExists":1,"startupFolderLnkExists":1}}&eng_time=1755395099&nocache=1003 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: d74queuslupub.cloudfront.netConnection: Keep-Alive

Found strings which match to known social media urls

Source: chromecache_382.1.dr, chromecache_403.1.dr, chromecache_380.1.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},Ik:function(){e=nb()},Gd:function(){d()}}};var Vb=wa(["data-gtm-yt-inspected-"]),XD=["www.youtube.com","www.youtube-nocookie.com"],YD,ZD=!1; equals www.youtube.com (Youtube)
Source: chromecache_382.1.dr, chromecache_388.1.dr, chromecache_387.1.dr, chromecache_403.1.dr, chromecache_380.1.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=DB(a,c,e);T(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return T(122),!0;if(d&&f){for(var m=yb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},GB=function(){var a=[],b=function(c){return bb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: msedgewebview2.exe, 0000002E.00000003.1949988750.000036F0008A0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002E.00000002.1986525017.000036F0008A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://microsoftstart.msn.cn/*https://rewards.microsoft.com/*https://www.microsoftnews.com/*https://www.facebook.com/*www.staging-bing-int.comaction.getBadgeTextColorbrowserAction.openPopupmanifest:browser_action@L equals www.facebook.com (Facebook)
Source: msedgewebview2.exe, 0000003C.00000002.2348386509.000078B0008A0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003C.00000003.2298222408.000078B000898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://microsoftstart.msn.cn/*https://rewards.microsoft.com/*https://www.microsoftnews.com/*https://www.facebook.com/*www.staging-bing-int.comaction.getBadgeTextColorhttps://outlook.live.com/*https://rewards.bing.com/* equals www.facebook.com (Facebook)
Source: msedgewebview2.exe, 00000019.00000003.1540389125.00003F7C008C0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000019.00000002.1573605308.00003F7C008C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://microsoftstart.msn.cn/*https://rewards.microsoft.com/*https://www.microsoftnews.com/*https://www.facebook.com/*www.staging-bing-int.comaction.getBadgeTextColorhttps://outlook.live.com/*https://rewards.bing.com/*https://www.microsoftnews.cn/*translatorserp.bing.comhttps://translator.bing.com/*N equals www.facebook.com (Facebook)
Source: msedgewebview2.exe, 00000014.00000002.1607903115.00001914004C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000019.00000003.1540389125.00003F7C008C0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000019.00000002.1573605308.00003F7C008C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/* equals www.facebook.com (Facebook)
Source: msedgewebview2.exe, 00000025.00000002.1820595894.000027C4008B8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000025.00000003.1786603020.000027C4008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/*translatorserp.bing.comhttps://rewards.microsoft.com/*https://translator.bing.com/* equals www.facebook.com (Facebook)
Source: chromecache_382.1.dr, chromecache_403.1.dr, chromecache_380.1.dr	String found in binary or memory: if(!(e||f||g||k.length||m.length))return;var p={Hh:e,Fh:f,Gh:g,mi:k,ni:m,Xe:n,Jb:b},q=A.YT;if(q)return q.ready&&q.ready(d),b;var r=A.onYouTubeIframeAPIReady;A.onYouTubeIframeAPIReady=function(){r&&r();d()};G(function(){for(var u=E.getElementsByTagName("script"),v=u.length,t=0;t<v;t++){var w=u[t].getAttribute("src");if(hE(w,"iframe_api")||hE(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,B=0;B<y;B++)if(!ZD&&fE(x[B],p.Xe))return lc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_388.1.dr, chromecache_387.1.dr	String found in binary or memory: return b}VD.F="internal.enableAutoEventOnTimer";var Vb=wa(["data-gtm-yt-inspected-"]),XD=["www.youtube.com","www.youtube-nocookie.com"],YD,ZD=!1; equals www.youtube.com (Youtube)
Source: chromecache_382.1.dr, chromecache_388.1.dr, chromecache_387.1.dr, chromecache_403.1.dr, chromecache_380.1.dr	String found in binary or memory: var jD=function(a,b,c,d,e){var f=aB("fsl",c?"nv.mwt":"mwt",0),g;g=c?aB("fsl","nv.ids",[]):aB("fsl","ids",[]);if(!g.length)return!0;var k=fB(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);T(121);if(m==="https://www.facebook.com/tr/")return T(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!Mz(k,Oz(b, equals www.facebook.com (Facebook)
Source: msedgewebview2.exe, 00000014.00000002.1602335358.0000191400020000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000019.00000002.1569180589.00003F7C00290000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1874790140.000001B0026E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)

Performs DNS lookups

Source: global traffic	DNS traffic detected: DNS query: veryfast.io
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: repcdn.pcapp.store
Source: global traffic	DNS traffic detected: DNS query: pcapp.store
Source: global traffic	DNS traffic detected: DNS query: delivery.pcapp.store
Source: global traffic	DNS traffic detected: DNS query: repository.pcapp.store
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: d74queuslupub.cloudfront.net

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /pixelgif.php HTTP/1.1Host: veryfast.ioConnection: keep-aliveContent-Length: 351sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/json;charset=UTF-8Accept: */*Origin: https://veryfast.ioSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _fcid=1736363911229592; default_lp=lp%2Flp_veryfast_main_r1; ml_lp_prediction_g_d_fast_in=lp26_farss_sd_r1; lp=%2Flp26_farss_sd_r1.html

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 Jan 2025 19:18:39 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingStrict-Transport-Security: max-age=31536000; includeSubDomains
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 Jan 2025 19:18:51 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 Jan 2025 19:18:52 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 Jan 2025 19:18:56 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 Jan 2025 19:19:01 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 Jan 2025 19:19:07 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 Jan 2025 19:19:11 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 Jan 2025 19:19:16 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-Encoding

URLs found in memory or binary data

Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://129fy.ie.chalai.net
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://511sllqdkj.yc.anhuang.net
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1849471837.000001B00260C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2038013665.00003F980260C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286A000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: msedgewebview2.exe, 00000014.00000003.1581110383.00001914003DC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000002.1606818255.00001914003E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00161000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2048357817.00003F980294C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C500000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286A000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00161000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00169000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1878497984.000001B002884000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1874350668.000001B0026B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286A000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00161000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00169000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1878497984.000001B002884000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533945849.00004EFC00185000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2040196108.00003F98026C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00161000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00169000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1872746523.000001B002629000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1878497984.000001B002884000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1849471837.000001B00260C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2054799414.00003F9802B18000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586V
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533945849.00004EFC00185000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00161000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1880588675.000001B002958000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2054036459.00003F9802AF0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2040196108.00003F98026C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1874350668.000001B0026B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00161000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1880588675.000001B002958000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2059826668.00003F9802E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.1945329574.00003F9802E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2048357817.00003F980294C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551$
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1849471837.000001B00260C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2054036459.00003F9802AF0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00169000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1878497984.000001B002884000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286A000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533945849.00004EFC00185000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00161000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00169000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1878497984.000001B002884000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286A000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C500000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1878497984.000001B002884000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000003.1536540615.0000191400AF4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2059826668.00003F9802E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.1945329574.00003F9802E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2394382031.00004C500020D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061B
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371%
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1874350668.000001B0026B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286A000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533945849.00004EFC00185000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2040196108.00003F98026C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00161000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00169000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1878497984.000001B002884000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000003.1536540615.0000191400AF4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2059826668.00003F9802E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.1945329574.00003F9802E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2394382031.00004C500020D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1874350668.000001B0026B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2059826668.00003F9802E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.1945329574.00003F9802E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533945849.00004EFC00185000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2059826668.00003F9802E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.1945329574.00003F9802E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/59060
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/59062
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/59063
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/59066
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/59067
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906A
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906F
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906H
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906J
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906L
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2059826668.00003F9802E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.1945329574.00003F9802E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2394382031.00004C500020D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141I
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1874350668.000001B0026B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00161000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00169000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1878497984.000001B002884000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1880588675.000001B002958000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2054036459.00003F9802AF0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1878497984.000001B002884000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2394382031.00004C500020D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/68785
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1874350668.000001B0026B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286A000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2059826668.00003F9802E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.1945329574.00003F9802E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953M
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1880588675.000001B002958000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2054036459.00003F9802AF0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00161000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00169000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1878497984.000001B002884000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1880588675.000001B002958000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2059826668.00003F9802E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.1945329574.00003F9802E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000003.1536540615.0000191400AF4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2059826668.00003F9802E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.1945329574.00003F9802E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2394382031.00004C500020D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488D
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2059826668.00003F9802E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.1945329574.00003F9802E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2394382031.00004C500020D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556K
Source: msedgewebview2.exe, 00000014.00000003.1581110383.00001914003DC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000002.1606818255.00001914003E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533688521.00004EFC00150000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00161000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1880588675.000001B002958000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000003.1782718704.00000DFC0015A000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2048357817.00003F980294C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000003.1944468854.000055FC00152000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C500000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000003.2290976479.00004C500015A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1874350668.000001B0026B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286A000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1874350668.000001B0026B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1878497984.000001B002884000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bd.gy912.com
Source: Setup.exe, 00000009.00000003.1467272730.0000000002C40000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1517959602.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp.9.dr, Uninstaller.exe.16.dr, 0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp.0.dr, Watchdog.exe.16.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Setup.exe, 00000009.00000003.1467272730.0000000002C40000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1517959602.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp.9.dr, Uninstaller.exe.16.dr, 0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp.0.dr, Watchdog.exe.16.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Setup.exe, 00000009.00000003.1467272730.0000000002C40000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1517959602.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp.9.dr, Uninstaller.exe.16.dr, 0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp.0.dr, Watchdog.exe.16.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Setup.exe, 00000009.00000003.1467272730.0000000002C40000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1517959602.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp.9.dr, Uninstaller.exe.16.dr, 0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp.0.dr, Watchdog.exe.16.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cdmg.yuchiweb.icu
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://click.dotmap.co.kr/?pf_code=
Source: Setup.exe, 00000009.00000003.1467272730.0000000002C40000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1517959602.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp.9.dr, Uninstaller.exe.16.dr, 0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp.0.dr, Watchdog.exe.16.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Setup.exe, 00000009.00000003.1467272730.0000000002C40000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1517959602.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp.9.dr, Uninstaller.exe.16.dr, 0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp.0.dr, Watchdog.exe.16.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Setup.exe, 00000009.00000003.1467272730.0000000002C40000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1517959602.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp.9.dr, Uninstaller.exe.16.dr, 0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp.0.dr, Watchdog.exe.16.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp.9.dr, Uninstaller.exe.16.dr, 0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp.0.dr, Watchdog.exe.16.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Setup.exe, 00000009.00000003.1467272730.0000000002C40000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1517959602.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp.9.dr, Uninstaller.exe.16.dr, 0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp.0.dr, Watchdog.exe.16.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://df.edge.bdkj.bailiana.com
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://df.edge.qhkj.baicana.com
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://df.edge.zdkj.ker58.com
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://df.zm.zdkj.ker58.com
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dongtaiwang.com/loc/phome.php?v=
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dongtaiwang.com/loc/phome.php?v=odo
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://game.whwuyan.cn
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hao123.di178.com/?
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hao123.di178.com/?r916
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hao123kjedge.dh.softby.cn
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jg.wangamela.com/tg
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mini.yyrtv.com/?from=
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://navi.anhuiyunci.com
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://navi.programmea.com
Source: Setup.exe, 00000009.00000000.1365194653.000000000040A000.00000008.00000001.01000000.00000004.sdmp, Setup.exe, 00000009.00000002.1468089871.000000000040A000.00000004.00000001.01000000.00000004.sdmp, nsnE8D9.tmp, 00000010.00000002.1517959602.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, nsnE8D9.tmp, 00000010.00000000.1459587590.000000000040A000.00000008.00000001.01000000.0000000D.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp.9.dr, Uninstaller.exe.16.dr, 0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp.0.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Setup.exe, 00000009.00000003.1467272730.0000000002C40000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1517959602.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp.9.dr, Uninstaller.exe.16.dr, 0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp.0.dr, Watchdog.exe.16.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: Setup.exe, 00000009.00000003.1467272730.0000000002C40000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1517959602.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp.9.dr, Uninstaller.exe.16.dr, 0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp.0.dr, Watchdog.exe.16.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Setup.exe, 00000009.00000003.1467272730.0000000002C40000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1517959602.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp.9.dr, Uninstaller.exe.16.dr, 0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp.0.dr, Watchdog.exe.16.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Setup.exe, 00000009.00000003.1467272730.0000000002C40000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1517959602.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp.9.dr, Uninstaller.exe.16.dr, 0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp.0.dr, Watchdog.exe.16.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r.emsoso.cn
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r.jgxqebp.cn
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://service.whchenxiang.com
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tx.edge.ker58.com
Source: msedgewebview2.exe, 00000014.00000002.1615626815.0000191400A74000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1887616914.000001B002C88000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2057252662.00003F9802C8C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2439931885.00006A3800AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://vi.liveen.vn/p/home.html
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://web.113989.com/?
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://web.503188.com/?
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.4399.com/flash/32979.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.4399.com/flash/48399.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.4399.com/flash/seer.htm
Source: Setup.exe, 00000009.00000003.1467272730.0000000002C40000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1517959602.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp.9.dr, Uninstaller.exe.16.dr, 0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp.0.dr, Watchdog.exe.16.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dinoklafbzor.org
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.hao123.com.11818wz.com/?e
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://xt.tiantianbannixue.com
Source: msedgewebview2.exe, 00000014.00000002.1604639402.00001914001AC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1868181653.000001B0023BC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2033865193.00003F98023AC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2409764463.00006A38001AC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://zn728.tdg68.com
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://123.sogou.com/?
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://360.qrfq25sg.xyz
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1868181653.000001B0023BC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2033865193.00003F98023AC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2409764463.00006A38001AC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://656a.com
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1872746523.000001B002629000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1849471837.000001B00260C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2054799414.00003F9802B18000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966d
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2059826668.00003F9802E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.1945329574.00003F9802E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574e
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1872746523.000001B002629000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1849471837.000001B00260C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2394382031.00004C500020D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1874350668.000001B0026B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2048357817.00003F980294C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00161000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533726353.00004EFC00169000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1878497984.000001B002884000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2443144741.00006A3800CA0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2059826668.00003F9802E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.1945329574.00003F9802E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1874350668.000001B0026B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1880588675.000001B002958000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.2003263082.00003F9802864000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2045561734.00003F980286A000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2054036459.00003F9802AF0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2059826668.00003F9802E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.1945329574.00003F9802E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2059826668.00003F9802E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000003.1945329574.00003F9802E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/73699
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1533811718.00004EFC00174000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1880588675.000001B002958000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2054036459.00003F9802AF0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2425717788.00006A3800670000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1889595072.000001B002E54000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1783571866.000001B002E50000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: msedgewebview2.exe, 00000014.00000002.1613369592.00001914008B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1593018220.00004EFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534202714.00004EFC001A5000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000003.1534016549.00004EFC001B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000016.00000002.1591186567.00004EFC0000C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1864289774.000001B00220C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1842149031.00000DFC00013000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000022.00000002.1845139994.00000DFC0020C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2028819441.00003F980221F000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2020161028.000055FC00038000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000002B.00000002.2024974528.000055FC0021C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2436622887.00006A38008F8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000037.00000002.2386286163.00004C5000016000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ausu.lol
Source: msedgewebview2.exe, 00000014.00000003.1580994891.0000191400410000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000002.1607019231.0000191400416000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1872746523.000001B00261A000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000003.1849471837.000001B00260C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2038013665.00003F980260C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2415750988.00006A3800418000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://baduk.hangame.com/?utm_source=baduk&utm_medium=icon&utm_campaign=shortcut
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://browser.360.cn/saas/index.html
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://browser.cloud.huawei.com.cn/pc
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://code.51.com
Source: Watchdog.exe, 00000012.00000003.1741961146.000001715D5AE000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1680742275.000001715D5AF000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1667746765.000001715D5AF000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1654496421.000001715D5AE000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1680742275.000001715D598000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1741961146.000001715D59B000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1654496421.000001715D59B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d74queuslupub.cl
Source: Watchdog.exe, 00000012.00000003.1741961146.000001715D5A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d74queuslupub.cloudfront
Source: Watchdog.exe, 00000012.00000003.1583527245.000001715D579000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1583527245.000001715D573000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d74queuslupub.cloudfront.net/
Source: Watchdog.exe, 00000012.00000002.2485342802.000001715D586000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1583527245.000001715D579000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d74queuslupub.cloudfront.net/(
Source: Watchdog.exe, 00000012.00000003.1819148052.000001715F24E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d74queuslupub.cloudfront.net/AppData
Source: Watchdog.exe, 00000012.00000003.1556425745.000001715F210000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1819148052.000001715F24E000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000002.2498173327.000001715F200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d74queuslupub.cloudfront.net/ata
Source: Watchdog.exe, 00000012.00000003.1654496421.000001715D573000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000002.2485342802.000001715D573000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1680742275.000001715D573000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1741961146.000001715D573000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d74queuslupub.cloudfront.net/ft
Source: Watchdog.exe, 00000012.00000003.1667746765.000001715D542000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1680742275.000001715D53E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d74queuslupub.cloudfront.net/p.gif?guid=
Source: Watchdog.exe, 00000012.00000002.2498173327.000001715F200000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000000.1508438820.00007FF60C90A000.00000002.00000001.01000000.00000015.sdmp, Watchdog.exe.16.dr	String found in binary or memory: https://d74queuslupub.cloudfront.net/p.gif?guid=%ws&version=%ws&evt_src=watch_dog&evt_action=signal_
Source: Watchdog.exe, 00000012.00000003.1816592248.000001715D5B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d74queuslupub.cloudfront.net/p.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002
Source: Watchdog.exe, 00000012.00000002.2485342802.000001715D573000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d74queuslupub.cloudfront.net/soft
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://daohang.96zxue.com
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://de.withtls.net
Source: Setup.exe, 00000009.00000003.1467330356.0000000002C1D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000009.00000002.1469803845.0000000002C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delivery.pcapp.store/
Source: Setup.exe, 00000009.00000003.1467330356.0000000002C1D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000009.00000002.1469803845.0000000002C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delivery.pcapp.store/4
Source: Setup.exe, 00000009.00000002.1468425668.000000000048A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=&evt_src=fa_mini_insta
Source: Setup.exe, 00000009.00000002.1468089871.0000000000436000.00000004.00000001.01000000.00000004.sdmp	String found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=ersion=fa.2002&src=pca
Source: Setup.exe, 00000009.00000002.1469637709.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=fa.2002A
Source: Setup.exe, 00000009.00000002.1469637709.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=fa.2002p
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dev.tg.wan.360.cn/?
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discovery.lenovo.com.cn/home
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discovery.lenovo.com.cn/home062291
Source: msedgewebview2.exe, 00000014.00000002.1604639402.00001914001AC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1868181653.000001B0023BC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2033865193.00003F98023AC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2409764463.00006A38001AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edge.ilive.cn
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gamebox.160.com/static
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.comlast_v=%ws&dl_lnk=%wsempty_instructionsno_internet_connectionend
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://h5.mcetab.com
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hao.360.cn/?a1004
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hao.360.com/?360safe
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hao.360.com/?a1004
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hao.360.com/?a1111
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hao.360.com/?h_lnk
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hao.360.com/?installer
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hao.360.com/?src=jsqth
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hao.360.com/?src=lm&ls=
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hao.360.com/?wd_xp1
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hao.360.com/?y1001
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hao.360.com/?y1002
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hao.360.com/?y1013
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hao.qq.com/?unc=
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hao.qq.com/?unc=Af31026&s=o400493_1
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hk.eynbm.com
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hlj04.com
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ilive.lenovo.com.cn/?f=
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://internet-start.net/?
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://jg.awaliwa.com
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://jianjie.2345.com
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://kf.07073.com
Source: Watchdog.exe, 00000012.00000003.1816592248.000001715D59B000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000002.2485342802.000001715D597000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1583527245.000001715D579000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000002.1602872573.0000191400074000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1868181653.000001B0023BC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1865700157.000001B0022B0000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2030262010.00003F980228C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2033865193.00003F98023AC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2409764463.00006A38001AC000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2404319260.00006A380008C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lx.pub
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lx.pub/
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mini.eastday.com/?qid=04433&rfstyle=qt
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://news.4399.com/aoyazhiguang/
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1507947709.00007FF7D4A99000.00000002.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	String found in binary or memory: https://pcapp.store%02Xunknown
Source: nsnE8D9.tmp, 00000010.00000003.1516640028.00000000039BA000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1518418908.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1565916101.000002327213F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1565916101.0000023272173000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1563506695.00000232702CC000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000003.1519786557.00000232720FD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1565916101.00000232720E9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1569018213.00007FF7D4B1A000.00000004.00000001.01000000.00000014.sdmp, PcAppStore.exe, 0000001F.00000002.1810949863.00007FF7D4B1A000.00000004.00000001.01000000.00000014.sdmp, PcAppStore.exe, 0000001F.00000002.1803517235.000002237441D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1803517235.000002237448F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761C6000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D978000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D8EC000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1975166202.00007FF7D4B1A000.00000004.00000001.01000000.00000014.sdmp, PcAppStore.exe, 00000028.00000002.1969853404.0000021E2F890000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D8FD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1969853404.0000021E2F8D4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B50000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/
Source: PcAppStore.exe, 00000011.00000002.1565916101.0000023272156000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761DF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B50000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//app
Source: PcAppStore.exe, 00000011.00000002.1565916101.000002327211F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1565916101.00000232720D0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1803517235.0000022374444000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D978000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6CF6000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//appstore-hint/?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002
Source: PcAppStore.exe, 00000011.00000002.1565916101.000002327211F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1565916101.00000232720D0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1803517235.000002237448F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D978000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6CF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//appstore-menu/?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002
Source: PcAppStore.exe, 00000011.00000002.1565916101.00000232720D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//appstore-settings/?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.20
Source: PcAppStore.exe, 00000011.00000002.1565916101.00000232720D0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1803517235.0000022374444000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D978000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D8FD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//appstore-settings/?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002
Source: PcAppStore.exe, 00000011.00000002.1565916101.000002327215B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//appstore-settings/?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002O
Source: PcAppStore.exe, 00000011.00000002.1565916101.000002327213F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1565916101.000002327215B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761DF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1803517235.000002237448F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D978000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6CF6000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//appstore-widget/?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&id=73273&version=fa.
Source: PcAppStore.exe, 00000011.00000002.1565916101.000002327213F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1565916101.000002327215B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761DF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1803517235.000002237448F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1969853404.0000021E2F8AF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D978000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6CF6000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//appstore-widget/?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&id=73412&version=fa.
Source: PcAppStore.exe, 00000011.00000002.1565916101.00000232720E9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1565916101.00000232720D0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761C6000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1969853404.0000021E2F890000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D8FD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6C9D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//images/front_img/appstore-settings/index_5/icon_check.png
Source: PcAppStore.exe, 00000011.00000002.1565916101.00000232720E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//images/front_img/appstore-settings/index_5/icon_check.pngK
Source: PcAppStore.exe, 00000011.00000002.1565916101.00000232720D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//images/front_img/appstore-settings/index_5/icon_check.pnghic
Source: PcAppStore.exe, 00000011.00000002.1565916101.00000232720E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//images/front_img/appstore-settings/index_5/icon_check.pngo
Source: PcAppStore.exe, 00000011.00000002.1565916101.0000023272106000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761DF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1803517235.0000022374444000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D978000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D966000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//search-menu/?a=getTemplate&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&p
Source: PcAppStore.exe, 00000011.00000002.1563506695.000002327039F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//search-menu/?a=getTemplate&p
Source: PcAppStore.exe, 00000011.00000002.1565916101.000002327214D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761C6000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1803517235.0000022374444000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1969853404.0000021E2F8AF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1969853404.0000021E2F890000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D8FD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B50000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src
Source: PcAppStore.exe, 00000011.00000002.1565916101.0000023272166000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1565916101.000002327214D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761DF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761C6000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D978000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1969853404.0000021E2F890000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6CF6000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appHint.js
Source: PcAppStore.exe, 00000011.00000002.1565916101.0000023272166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appHint.jsg
Source: PcAppStore.exe, 00000011.00000002.1565916101.0000023272166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appHint.jsue
Source: PcAppStore.exe, 00000011.00000002.1563506695.000002327039F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1565916101.0000023272156000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1565916101.000002327214D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761DF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1969853404.0000021E2F8AF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D966000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appMenuStore.js
Source: PcAppStore.exe, 00000011.00000002.1565916101.000002327214D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appMenuStore.jsc
Source: PcAppStore.exe, 00000011.00000002.1565916101.0000023272166000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761DF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1803517235.0000022374444000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D978000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D966000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6CF6000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appOffer.js
Source: PcAppStore.exe, 00000011.00000002.1563506695.000002327039F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appOffer.jsf
Source: PcAppStore.exe, 00000011.00000002.1565916101.000002327214D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appOffer.jsu.js
Source: PcAppStore.exe, 00000011.00000002.1565916101.000002327214D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1803517235.000002237448F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761C6000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D966000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1969853404.0000021E2F890000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appSearchMenu.js
Source: PcAppStore.exe, 00000011.00000002.1565916101.000002327214D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appSearchMenu.jsore.j
Source: PcAppStore.exe, 00000011.00000002.1565916101.0000023272166000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1563506695.000002327039F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761DF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6CF6000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appSettings.js
Source: PcAppStore.exe, 00000011.00000002.1565916101.0000023272166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appSettings.js_
Source: PcAppStore.exe, 00000011.00000002.1565916101.000002327214D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D966000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appSettings.jss
Source: PcAppStore.exe, 00000011.00000002.1565916101.0000023272166000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1563506695.000002327039F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1565916101.000002327214D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761DF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D978000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D966000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1969853404.0000021E2F890000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6CF6000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appStore.js
Source: PcAppStore.exe, 00000011.00000002.1565916101.0000023272166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appStore.js1
Source: PcAppStore.exe, 00000011.00000002.1565916101.0000023272166000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1565916101.0000023272156000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761DF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1803517235.000002237448F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D978000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6CF6000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appWidget.js
Source: PcAppStore.exe, 00000011.00000002.1565916101.0000023272166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appWidget.js/appSett
Source: PcAppStore.exe, 00000011.00000002.1563506695.000002327039F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appWidget.jsszMGC8WgdzkMRORQCsKhc
Source: PcAppStore.exe, 00000011.00000002.1565916101.0000023272166000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1563506695.000002327039F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appWindow.js#
Source: PcAppStore.exe, 00000011.00000002.1565916101.0000023272166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appWindow.js?
Source: PcAppStore.exe, 00000011.00000002.1565916101.0000023272156000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store//src/app/appWindow.jsI
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, ReadMe.txt.16.dr	String found in binary or memory: https://pcapp.store/?p=lpd_appstore-faq
Source: PcAppStore.exe, 00000011.00000002.1565916101.00000232720E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/AVRXP
Source: Setup.exe, 00000009.00000002.1469637709.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/E
Source: nsnE8D9.tmp, 00000010.00000002.1518418908.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/F2
Source: PcAppStore.exe, 00000011.00000002.1563506695.0000023270348000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1803517235.0000022374444000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/M=
Source: PcAppStore.exe, 00000011.00000002.1563506695.0000023270321000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/Q=
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1507947709.00007FF7D4A99000.00000002.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	String found in binary or memory: https://pcapp.store/account/logintray_exitx
Source: PcAppStore.exe, 00000011.00000002.1565916101.00000232720D0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1803517235.0000022374444000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D8EC000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D8FD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/api/pcapp_engine.php?a=config&guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1507947709.00007FF7D4A99000.00000002.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	String found in binary or memory: https://pcapp.store/cpg_fa.php?guid=An
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1507947709.00007FF7D4A99000.00000002.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	String found in binary or memory: https://pcapp.store/dl_cta_open.php?guid=%ws&id=%lu&type=%ws
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1507947709.00007FF7D4A99000.00000002.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	String found in binary or memory: https://pcapp.store/dl_cta_open.php?guid=%ws&oid=%lu&entryApp=%ws
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/fa_version.php?guid=%ws&end_v=%ws&nocache=%d
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/fa_version.php?guid=%ws&res=link&nocache=%d
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029D7000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1518418908.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/inst_cpg.php?guid=&src=pcapp_full.
Source: Setup.exe, 00000009.00000002.1468425668.00000000004F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/inst_cpg.php?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&_fcid=1736363911229592&ve
Source: nsnE8D9.tmp, 00000010.00000002.1522462580.0000000003960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/inst_cpg.php?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&src=pcapp
Source: Setup.exe, 00000009.00000002.1468425668.000000000048A000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029D7000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1518418908.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/installing.php?guid=&winver=
Source: PcAppStore.exe, 00000011.00000002.1565916101.000002327213F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000003.1519786557.00000232720FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/n
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1507947709.00007FF7D4A99000.00000002.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	String found in binary or memory: https://pcapp.store/notify_app_v2.php?guid=&lastid=&lasttime=&nocache=&end_v=%ws%ws%ws%d%ws%d%ws%ws%
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029D7000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1518418908.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/pixel.gif?guid=&version=&evt_src=fa_installer&evt_action=localmac
Source: Setup.exe, 00000009.00000003.1467330356.0000000002C25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/pixel.gif?guid=56BB2
Source: nsnE8D9.tmp, 00000010.00000002.1518418908.00000000007F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_i
Source: Setup.exe, 00000009.00000003.1467330356.0000000002C25000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000009.00000002.1469803845.0000000002C2B000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000009.00000002.1469803845.0000000002C34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_m
Source: PcAppStore.exe, 00000011.00000002.1565916101.00000232720D0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761DF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.000002237625A000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1803517235.000002237448F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1969853404.0000021E2F8AF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D978000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D8FD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1969853404.0000021E2F925000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1969853404.0000021E2F8D4000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8BC5000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6CF6000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8BB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=fa_p
Source: nsnE8D9.tmp, 00000010.00000002.1518418908.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&inst_parent=
Source: Setup.exe, 00000009.00000003.1467330356.0000000002C25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/pixel.gif?guid=56BB2E
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1507947709.00007FF7D4A99000.00000002.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	String found in binary or memory: https://pcapp.store/pixel.gifC:
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1507947709.00007FF7D4A99000.00000002.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	String found in binary or memory: https://pcapp.store/pixel.gifcurrent_path()
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029D7000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1518418908.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/privacy.html?guid=By
Source: Setup.exe, 00000009.00000002.1468425668.000000000048A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/privacy.html?guid=welhttps://pcapp.store/pixel.gif?guid=&version=&evt_src=fa_min
Source: Setup.exe, 00000009.00000002.1468425668.000000000048A000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029D7000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1518418908.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store/tos.html?guid=
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1507947709.00007FF7D4A99000.00000002.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	String found in binary or memory: https://pcapp.store/wgetenv_errorUSERPROFILETemp
Source: PcAppStore.exe, 00000011.00000002.1565916101.0000023272106000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.00000223761DF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001F.00000002.1807210933.000002237622D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1969853404.0000021E2F8AF000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000028.00000002.1964805499.0000021E2D8FD000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8BA1000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcapp.store:443/pixel.gif?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&version=fa.2002&evt_src=
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pcappstore.s3.amazonaws.com/versionrinstruction_failed%ws?guid=%ws&nocache=%dauto_updater.ex
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redian.mnjunshi.com/?qid=tpnews
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redian.mnjunshi.com/?qid=tpnewsy_pcuni
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1507947709.00007FF7D4A99000.00000002.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	String found in binary or memory: https://search.pcapp.store/r.html?q=%ws&br=%ws&en=%ws&guid=%ws&end_v=%ws
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://so.lenovo.com.cn
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1876416731.000001B002784000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2043464108.00003F9802788000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2423420601.00006A38005B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssjj.4399.com/
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://start.jword.jp/?fr=slc
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tg.602.com
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tj.xyhvip.cn
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tp.9377s.com
Source: msedgewebview2.exe, 00000014.00000002.1600520776.000001998AAEB000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000002.1600520776.000001998AAF6000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000002.1600520776.000001998AAC8000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000003.1533395814.000001998FB17000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000002.1601803272.000001998FB02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: msedgewebview2.exe, 00000014.00000002.1600520776.000001998AAEB000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000002.1600520776.000001998AAF6000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000002.1600520776.000001998AAC8000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000003.1533395814.000001998FB17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: msedgewebview2.exe, 00000014.00000002.1600520776.000001998AAEB000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000002.1600520776.000001998AAF6000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000002.1600520776.000001998AAC8000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000003.1533395814.000001998FB17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.sogou.com/?
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000014.00000002.1602965011.000019140008C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1867541008.000001B002370000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2032905215.00003F9802350000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2408427063.00006A3800150000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.2345.com/?
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/100030_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/10305_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/10379.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/10379_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/107884_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/109832_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/110975_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/112689_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/115339_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/117227_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/117945_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/118852_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/122099_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/12669_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/127539_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/130389_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/130396.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/130396_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/132028.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/133630_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/134302_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/136516_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/137116_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/137953_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/1382_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/145991_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/151915_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/155283_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/155476_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/15548_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/160944_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/163478_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/171322_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/173634_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/177937_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/17801_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/18012.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/18012.htmhttps://www.4399.com/flash/17801_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/18012_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/180977_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/18169_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/187040_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/187228_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/188593.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/188739_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/189558_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/191203_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/195673_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/195990_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/198491_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/198637_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/198660_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/199408_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202061_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202574_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202604_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202692_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202724_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202785.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202819_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202828_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202901_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202907_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202911_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203018_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203093_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203152.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203153_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203154.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203166_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203178_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203215_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203231_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203369_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203371_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203404_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203453_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203476_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203481_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203495_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203515_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203564_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203682_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203768_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204044_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204056_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204206.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204255_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204290_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204422_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204429_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204562_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204650_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204685_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204886_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204926_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204952_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204989_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205090_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205147.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205165.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205182.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205182.htmhttps://www.4399.com/flash/205165.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205235_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205325_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205341_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205462_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205536_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205551_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205845_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/206114_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/20660_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/206724_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/207195_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/207717_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/208107_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877420858.000001B0027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/209567_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/210650_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/212767_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/21552_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/216417_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/21674_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217370_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217603_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217622_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217629_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217706_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217815_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217844_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217855_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217926_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/218066_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/218162_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/218717_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/218860_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/218939_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/220266_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/221162_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/221700_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/221839_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/222061_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/222151_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/222442_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/22287_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/223745.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/223745_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/225193_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/227465_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/230446_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/231814_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/27924.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/27924_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/32979_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/35538.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/35538_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/3881_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/3883_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/39379_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/40779_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/41193_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/42760_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/43689_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/43841_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/47931_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/48272_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/48504.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/48504.htmhttps://ssjj.4399.com/
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/48504_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/55146_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/59227_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/60369_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/6232_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/63805_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/65731_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/69112_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/69156_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/70215_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/72526_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/73386.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/776_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/79452_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/81895_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/83345_4.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/85646_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/87425_2.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/88902_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/90302_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/93015_1.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/93398_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/93551_3.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/yzzrhj.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/zmhj.htm
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.91duba.com/?
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.91duba.com/?f=
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/s?tn=15007414_9_dg&wd=
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.douyin.com/?ug_source=
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.flash.cn/success
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iduba.com/sv.html?f=
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.jiegeng.com
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nate.com/?f=nateontb
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newduba.cn/?
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.so.com/?src=
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.startfenster.de
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.startseite24.net
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yxtg.3zwx.cn/tg/ttfc.html?sc=
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yxtg.flamebird.cn/tg/ttfc.html?sc=
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424253699.00006A38005F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yxtg.taojike.com.cn/tg/ttfc.html?sc=
Source: msedgewebview2.exe, 00000014.00000002.1609326343.00001914005C4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1877668351.000001B00280C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2044496131.00003F98027E4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2424514740.00006A380060C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://zum.com/?af=

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 169.150.255.184:443 -> 192.168.2.18:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.205.91:443 -> 192.168.2.18:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.10:443 -> 192.168.2.18:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.113.200.164:443 -> 192.168.2.18:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.118:443 -> 192.168.2.18:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.248.126.225:443 -> 192.168.2.18:49932 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global mouse hook

Source: C:\Users\user\PCAppStore\PcAppStore.exe

Windows user hook set: 0 mouse low level C:\Users\user\PCAppStore\PcAppStore.exe

Jump to behavior

DDoS

Too many similar processes found

Source: msedgewebview2.exe

Process created: 47

System Summary

Blob-based file download detected

Source: C:\Users\user\Downloads\Setup.exe

File download: blob:https://veryfast.io/a7576a85-dff6-4cc2-aba2-110cdf6db42b

Abnormal high CPU Usage

Source: C:\Users\user\PCAppStore\Watchdog.exe

Process Stats: CPU usage > 24%

One or more processes crash

Source: C:\Users\user\PCAppStore\PcAppStore.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5692 -s 2672

Classification label

Source: classification engine

Classification label: mal68.evad.mine.win@92/339@37/18

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Creates mutexes

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5692
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6324
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7664
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6316

Creates temporary files

Source: C:\Users\user\Downloads\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\nsyD222.tmp

Jump to behavior

Queries process information (via WMI, Win32_Process)

Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor

Reads ini files

Source: C:\Users\user\Downloads\Setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Downloads\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts

Runs a DLL by calling functions

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

SQL strings found in memory and binary data

Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: SELECT sql FROM%d UNION ALL SELECT shell_add_schema(sql,mainNULL,name) AS sql, type, tbl_name, name, rowid, AS snum, AS sname FROM .sqlite_schema UNION ALL SELECT shell_module_schema(name), 'table', name, name, name, 9e+99, 'main' FROM pragma_module_list) WHERE %Qlower(printf('%s.%s',sname,tbl_name))lower(tbl_name) GLOB LIKE ESCAPE '\' AND name NOT LIKE 'sqlite_%%' AND sql IS NOT NULL ORDER BY snum, rowidSQL: %s;
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','%q','%q',0,'%q');%s
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: SELECT max(length(key)) FROM temp.sqlite_parameters;
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: CREATE TABLE ColNames( cpos INTEGER PRIMARY KEY, name TEXT, nlen INT, chop INT, reps INT, suff TEXT);CREATE VIEW RepeatedNames AS SELECT DISTINCT t.name FROM ColNames t WHERE t.name COLLATE NOCASE IN ( SELECT o.name FROM ColNames o WHERE o.cpos<>t.cpos);
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: SELECT type,name,tbl_name,sql FROM sqlite_schema ORDER BY name;
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: SELECT key, quote(value) FROM temp.sqlite_parameters;
Source: msedgewebview2.exe, 00000014.00000003.1593645323.00001914003B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE urls(id INTEGER PRIMARY KEY AUTOINCREMENT,url LONGVARCHAR,title LONGVARCHAR,visit_count INTEGER DEFAULT 0 NOT NULL,typed_count INTEGER DEFAULT 0 NOT NULL,last_visit_time INTEGER NOT NULL,hidden INTEGER DEFAULT 0 NOT NULL)>;
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: SELECT 'CREATE TEMP' || substr(sql, 7) FROM sqlite_schema WHERE tbl_name = %Q AND type IN ('table', 'trigger') ORDER BY type;
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: INSERT INTO selftest(tno,op,cmd,ans) SELECT rowid*10,op,cmd,ans FROM [_shell$self];
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: SELECT * FROM "%w" ORDER BY rowid DESC;Warning: cannot step "%s" backwardsSELECT name, sql FROM sqlite_schema WHERE %sError: (%d) %s on [%s]
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','%q','%q',0,'%q');
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: SELECT * FROM "%w" ORDER BY rowid DESC;
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: SELECT tbl,idx,stat FROM sqlite_stat1 ORDER BY tbl,idx;
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: SELECT 'EXPLAIN QUERY PLAN SELECT 1 FROM ' || quote(s.name) || ' WHERE ' || group_concat(quote(s.name) || '.' || quote(f.[from]) || '=?' || fkey_collate_clause( f.[table], COALESCE(f.[to], p.[name]), s.name, f.[from]),' AND '), 'SEARCH ' || s.name || ' USING COVERING INDEX*(' || group_concat('*=?', ' AND ') || ')', s.name || '(' || group_concat(f.[from], ', ') || ')', f.[table] || '(' || group_concat(COALESCE(f.[to], p.[name])) || ')', 'CREATE INDEX ' || quote(s.name ||'_'|| group_concat(f.[from], '_')) || ' ON ' || quote(s.name) || '(' || group_concat(quote(f.[from]) || fkey_collate_clause( f.[table], COALESCE(f.[to], p.[name]), s.name, f.[from]), ', ') || ');', f.[table] FROM sqlite_schema AS s, pragma_foreign_key_list(s.name) AS f LEFT JOIN pragma_table_info AS p ON (pk-1=seq AND p.arg=f.[table]) GROUP BY s.name, f.id ORDER BY (CASE WHEN ? THEN f.[table] ELSE s.name END)
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: SELECT 'CREATE TEMP' || substr(sql, 7) FROM sqlite_schema WHERE tbl_name = %Q AND type IN ('table', 'trigger') ORDER BY type;ALTER TABLE temp.%Q RENAME TO %QINSERT INTO %Q VALUES(, %s?)UPDATE %Q SET , %s%Q=?DELETE FROM %QSELECT type, name, sql, 1 FROM sqlite_schema WHERE type IN ('table','view') AND name NOT LIKE 'sqlite_%%' UNION ALL SELECT type, name, sql, 2 FROM sqlite_schema WHERE type = 'trigger' AND tbl_name IN(SELECT name FROM sqlite_schema WHERE type = 'view') ORDER BY 4, 1CREATE TABLE x(, %s%Q COLLATE %s)CREATE VIRTUAL TABLE %Q USING expert(%Q)SELECT max(i.seqno) FROM sqlite_schema AS s, pragma_index_list(s.name) AS l, pragma_index_info(l.name) AS i WHERE s.type = 'table', %sx.%Q IS rem(%d, x.%Q) COLLATE %s%s%dSELECT %s FROM %Q x ORDER BY %sSELECT %s FROM temp.t592690916721053953805701627921227776 x ORDER BY %s%d %dDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776CREATE TABLE temp.t592690916721053953805701627921227776 AS SELECT * FROM %QSELECT s.rowid, s.name, l.name FROM sqlite_schema AS s, pragma_index_list(s.name) AS l WHERE s.type = 'table'SELECT name, coll FROM pragma_index_xinfo(?) WHERE keyINSERT INTO sqlite_stat1 VALUES(?, ?, ?)ANALYZE; PRAGMA writable_schema=1remsampleDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776ANALYZE sqlite_schemaDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776:memory::memory:SELECT sql FROM sqlite_schema WHERE name NOT LIKE 'sqlite_%%' AND sql NOT LIKE 'CREATE VIRTUAL %%'Cannot find a unique index name to propose. -- stat1: %s;%s%s
Source: msedgewebview2.exe, 00000014.00000002.1610295525.00001914006B4000.00000004.00000800.00020000.00000000.sdmp, Login Data.20.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: INSERT OR IGNORE INTO "%s" VALUES(?,?);Error %d: %s on [%s]
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1508088586.00007FF7D4AF7000.00000008.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: SELECT name,seq FROM sqlite_sequence ORDER BY name;

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1900,i,2522827894995120924,7428638534070553184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwE"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5408 --field-trial-handle=1900,i,2522827894995120924,7428638534070553184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 --field-trial-handle=1900,i,2522827894995120924,7428638534070553184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5844 --field-trial-handle=1900,i,2522827894995120924,7428638534070553184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\Setup.exe "C:\Users\user\Downloads\Setup.exe"
Source: C:\Users\user\Downloads\Setup.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://pcapp.store/installing.php?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&winver=19045&version=fa.2002&nocache=20250108141848.112&_fcid=1736363911229592
Source: C:\Users\user\Downloads\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp "C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp" /internal 1736363911229592 /force
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Process created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Process created: C:\Users\user\PCAppStore\Watchdog.exe "C:\Users\user\PCAppStore\Watchdog.exe" /guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED /rid=20250108141857.2995704078 /ver=fa.2002
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5692.364.5173740132215257085
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\PCAppStore\UserData\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\PCAppStore\UserData\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffd98ef8e88,0x7ffd98ef8e98,0x7ffd98ef8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2216 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2396 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1736358233059789 --launch-time-ticks=5706779554 --mojo-platform-channel-handle=3392 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5692 -s 2672
Source: unknown	Process created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default showM
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6324.7232.10845545368448902965
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\PCAppStore\UserData\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\PCAppStore\UserData\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffd98d28e88,0x7ffd98d28e98,0x7ffd98d28ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=1932 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2188 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1736358233057676 --launch-time-ticks=5731523212 --mojo-platform-channel-handle=3272 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6324 -s 2620
Source: unknown	Process created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default showM
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6316.2960.1563966726545566937
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\PCAppStore\UserData\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\PCAppStore\UserData\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x124,0x170,0x7ffda8d48e88,0x7ffda8d48e98,0x7ffda8d48ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2304 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2696 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1736358233060135 --launch-time-ticks=5747682704 --mojo-platform-channel-handle=3260 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6316 -s 2636
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default showM
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=7664.1756.15447033616939545645
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\PCAppStore\UserData\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\PCAppStore\UserData\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffda87b8e88,0x7ffda87b8e98,0x7ffda87b8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2900 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=3324 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7664 -s 2368
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1736358233059908 --launch-time-ticks=5782379095 --mojo-platform-channel-handle=3500 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1900,i,2522827894995120924,7428638534070553184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5408 --field-trial-handle=1900,i,2522827894995120924,7428638534070553184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 --field-trial-handle=1900,i,2522827894995120924,7428638534070553184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5844 --field-trial-handle=1900,i,2522827894995120924,7428638534070553184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\Setup.exe "C:\Users\user\Downloads\Setup.exe"			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 --field-trial-handle=1900,i,2522827894995120924,7428638534070553184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://pcapp.store/installing.php?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&winver=19045&version=fa.2002&nocache=20250108141848.112&_fcid=1736363911229592			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp "C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp" /internal 1736363911229592 /force			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Process created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Process created: C:\Users\user\PCAppStore\Watchdog.exe "C:\Users\user\PCAppStore\Watchdog.exe" /guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED /rid=20250108141857.2995704078 /ver=fa.2002			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\PCAppStore\UserData\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\PCAppStore\UserData\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffd98ef8e88,0x7ffd98ef8e98,0x7ffd98ef8ea8			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=MojoIpcz /prefetch:2			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2216 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=MojoIpcz /prefetch:3			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2396 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=MojoIpcz /prefetch:8			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1736358233059789 --launch-time-ticks=5706779554 --mojo-platform-channel-handle=3392 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=MojoIpcz /prefetch:1			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6324.7232.10845545368448902965
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\PCAppStore\UserData\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\PCAppStore\UserData\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffd98d28e88,0x7ffd98d28e98,0x7ffd98d28ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=1932 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2188 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1736358233057676 --launch-time-ticks=5731523212 --mojo-platform-channel-handle=3272 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6316.2960.1563966726545566937
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\PCAppStore\UserData\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\PCAppStore\UserData\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x124,0x170,0x7ffda8d48e88,0x7ffda8d48e98,0x7ffda8d48ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2304 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2696 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1736358233060135 --launch-time-ticks=5747682704 --mojo-platform-channel-handle=3260 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=7664.1756.15447033616939545645
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\PCAppStore\UserData\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\PCAppStore\UserData\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffda87b8e88,0x7ffda87b8e98,0x7ffda87b8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2900 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=3324 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1736358233059908 --launch-time-ticks=5782379095 --mojo-platform-channel-handle=3500 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=MojoIpcz /prefetch:1

Tries to load missing DLLs

Source: C:\Users\user\Downloads\Setup.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: acgenral.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: samcli.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: msacm32.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: dwmapi.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: mpr.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: winmmbase.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: winmmbase.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: oleacc.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: shfolder.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: secur32.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: schannel.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: mskeyprotect.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: ncryptsslp.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: riched20.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: usp10.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: msls31.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: textshaping.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: edputil.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: windows.staterepositoryps.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: appresolver.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: bcp47langs.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: slc.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: sppc.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: onecoreuapcommonproxystub.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: dwmapi.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: oleacc.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: shfolder.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: amsi.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: schannel.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: mskeyprotect.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: ncryptsslp.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: dhcpcsvc.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: secur32.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: linkinfo.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: ntshrui.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Section loaded: cscapi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wlanapi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: dwmapi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wtsapi32.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: secur32.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: msi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: amsi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: pcappdebugger.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: eventsviewer.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: webio.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: uiautomationcore.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wbemcomn.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: eventsviewer.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: windows.ui.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: windowmanagementapi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: inputhost.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: twinapi.appcore.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: twinapi.appcore.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: schannel.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: winsta.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: mskeyprotect.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ncryptsslp.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: edputil.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: dbghelp.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: urlmon.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: srvcli.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: sspicli.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: ondemandconnroutehelper.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: mswsock.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: winnsi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: rasadhlp.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: schannel.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: mskeyprotect.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: ntasn1.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: ncrypt.dll			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Section loaded: ncryptsslp.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: ntmarta.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.system.profile.platformdiagnosticsandusagedatasettings.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: policymanager.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winmm.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kbdus.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.system.profile.platformdiagnosticsandusagedatasettings.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: policymanager.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: gpapi.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wkscli.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: netutils.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mdmregistration.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mdmregistration.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: omadmapi.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: powrprof.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dmcmnutils.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: iri.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: umpdc.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dsreg.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: powrprof.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: umpdc.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dwrite.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dpapi.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: nlaapi.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: iphlpapi.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dhcpcsvc6.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dhcpcsvc.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dnsapi.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: textinputframework.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: coreuicomponents.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: coremessaging.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wintypes.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.storage.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.ui.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windowmanagementapi.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: inputhost.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: twinapi.appcore.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: twinapi.appcore.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: propsys.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: profapi.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mscms.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: coloradapterclient.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wtsapi32.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winsta.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winhttp.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.security.authentication.web.core.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: iertutil.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: onecorecommonproxystub.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dxgi.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: resourcepolicyclient.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mf.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mfplat.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: rtworkq.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: hevcdecoder.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dolbydecmft.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mfperfhelper.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: devobj.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dataexchange.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: d3d11.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dcomp.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dxgi.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dwmapi.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: netapi32.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uiautomationcore.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: atlthunk.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: oleacc.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: directmanipulation.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: d3d11.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: d3d10warp.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dxcore.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dcomp.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dbghelp.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dwrite.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wldp.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: policymanager.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: nlaapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winmm.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: version.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: urlmon.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wlanapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: winhttp.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: secur32.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wininet.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: msi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: iertutil.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: srvcli.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: netutils.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: profapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: sspicli.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: amsi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: userenv.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: pcappdebugger.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: eventsviewer.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: propsys.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: winnsi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: eventsviewer.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: windows.ui.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: windowmanagementapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: inputhost.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wintypes.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wintypes.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: wldp.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: winsta.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: mswsock.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: dpapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: msasn1.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: gpapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: schannel.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: edputil.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: webio.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.system.profile.platformdiagnosticsandusagedatasettings.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: policymanager.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kbdus.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.system.profile.platformdiagnosticsandusagedatasettings.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: policymanager.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mdmregistration.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mdmregistration.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: omadmapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dmcmnutils.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: iri.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dsreg.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dwrite.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dpapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: nlaapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.ui.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windowmanagementapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: inputhost.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mscms.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: coloradapterclient.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.security.authentication.web.core.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: atlthunk.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: directmanipulation.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mf.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mfplat.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: rtworkq.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: hevcdecoder.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dolbydecmft.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mfperfhelper.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: d3d10warp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dxcore.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dbghelp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dwrite.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: policymanager.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: iphlpapi.dll

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Downloads\Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Windows shortcut file (LNK) contains relative path

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: PC App Store.lnk.16.dr	LNK file: ..\..\..\..\..\..\PCAppStore\PcAppStore.exe

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCAppStore

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: C:\Build\Build_2002_D20241129T170824\fa_rss\AppStoreUpdater\Release\auto_updater.pdb source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Build\Build_2002_D20241129T170824\fa_rss\AppStoreUpdater\Release\auto_updater.pdb1 source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Build\Build_2002_D20241129T170824\fa_rss\Watchdog\x64\Release\Watchdog.pdb source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000000.1508438820.00007FF60C90A000.00000002.00000001.01000000.00000015.sdmp, Watchdog.exe.16.dr
Source:	Binary string: C:\Users\zak\Downloads\Inetc\Unicode\Plugins\inetc.pdb source: Setup.exe, 00000009.00000002.1468089871.000000000040A000.00000004.00000001.01000000.00000004.sdmp, nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, inetc.dll.16.dr, inetc.dll.9.dr
Source:	Binary string: C:\Build\Build_2002_D20241129T170824\fa_rss\engine\Release\PCAppStore.pdb source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1507947709.00007FF7D4A99000.00000002.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr

Data Obfuscation

PE file contains an invalid checksum

Source: System.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x3d68
Source: nsJSON.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x6718
Source: nsJSON.dll.9.dr	Static PE information: real checksum: 0x0 should be: 0x6718
Source: 0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp.0.dr	Static PE information: real checksum: 0x34078 should be: 0x3e818
Source: inetc.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x13c41
Source: System.dll.9.dr	Static PE information: real checksum: 0x0 should be: 0x3d68
Source: nsDialogs.dll.9.dr	Static PE information: real checksum: 0x0 should be: 0x2f9b
Source: NSISFastLib.dll.9.dr	Static PE information: real checksum: 0x0 should be: 0x30512
Source: Math.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x155a8
Source: NSISFastLib.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x30512
Source: inetc.dll.9.dr	Static PE information: real checksum: 0x0 should be: 0x13c41

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Downloads\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp			Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsyD223.tmp\NSISFastLib.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	File created: C:\Users\user\PCAppStore\Watchdog.exe			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\0505bbdc-c4f1-47f7-bd84-00988c8eeafa.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	File created: C:\Users\user\PCAppStore\Uninstaller.exe			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 865809.crdownload (copy)			Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsyD223.tmp\System.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	File created: C:\Users\user\AppData\Local\Temp\nsiF6F2.tmp\inetc.dll			Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsyD223.tmp\nsJSON.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	File created: C:\Users\user\AppData\Local\Temp\nsiF6F2.tmp\NSISFastLib.dll			Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsyD223.tmp\nsDialogs.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	File created: C:\Users\user\PCAppStore\AutoUpdater.exe			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Setup.exe (copy)			Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsyD223.tmp\inetc.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	File created: C:\Users\user\AppData\Local\Temp\nsiF6F2.tmp\nsJSON.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	File created: C:\Users\user\AppData\Local\Temp\nsiF6F2.tmp\Math.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	File created: C:\Users\user\AppData\Local\Temp\nsiF6F2.tmp\System.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	File created: C:\Users\user\PCAppStore\PcAppStore.exe			Jump to dropped file

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp

File created: C:\Users\user\PCAppStore\ReadMe.txt

Jump to behavior

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Watchdog			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStore			Jump to behavior

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk			Jump to behavior

Creates an autostart registry key

Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStore			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStore			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Watchdog			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Watchdog			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\PCAppStore\PcAppStore.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive

Contains long sleeps (>= 3 min)

Source: C:\Users\user\PCAppStore\Watchdog.exe

Thread delayed: delay time: 300000

Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\PCAppStore\Watchdog.exe	Window / User API: threadDelayed 1997			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Window / User API: threadDelayed 7602			Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Downloads\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyD223.tmp\NSISFastLib.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\Uninstaller.exe			Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyD223.tmp\System.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiF6F2.tmp\inetc.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiF6F2.tmp\NSISFastLib.dll			Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyD223.tmp\nsJSON.dll			Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyD223.tmp\nsDialogs.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\AutoUpdater.exe			Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyD223.tmp\inetc.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiF6F2.tmp\nsJSON.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiF6F2.tmp\Math.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiF6F2.tmp\System.dll			Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 6536	Thread sleep count: 1997 > 30			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 6536	Thread sleep time: -119820000s >= -30000s			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 548	Thread sleep time: -2100000s >= -30000s			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 6536	Thread sleep count: 7602 > 30			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 6536	Thread sleep time: -456120000s >= -30000s			Jump to behavior

Queries keyboard layouts

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\PCAppStore\PcAppStore.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\PCAppStore\PcAppStore.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\PCAppStore\PcAppStore.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\PCAppStore\PcAppStore.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\PCAppStore\PcAppStore.exe	Last function: Thread delayed
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Last function: Thread delayed
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Last function: Thread delayed
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Last function: Thread delayed

Checks the free space of harddrives

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Code Cache\js FullSizeInformation			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Code Cache\wasm FullSizeInformation			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Code Cache\wasm FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Code Cache\js FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Code Cache\wasm FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Code Cache\js FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Code Cache\wasm FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Code Cache\js FullSizeInformation

Contains medium sleeps (>= 30s)

Source: C:\Users\user\PCAppStore\Watchdog.exe	Thread delayed: delay time: 60000			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Thread delayed: delay time: 300000			Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Thread delayed: delay time: 60000			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: PcAppStore.exe, 00000011.00000003.1519565983.000002327039D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPR
Source: PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6C9D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductX1HCSK56BB2742-D4AD-D40B-0E05-59D15B59EFEDVMware, Inc.Noney*
Source: PcAppStore.exe, 00000034.00000002.2314572536.000001BBA6C9D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: PcAppStore.exe, 00000034.00000002.2321581612.000001BBA8B50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%\System32\fveui.dll,-843
Source: Setup.exe, 00000009.00000002.1469637709.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWK
Source: PcAppStore.exe, 00000011.00000002.1563506695.0000023270339000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductX1HCSK56BB2742-D4AD-D40B-0E05-59D15B59EFEDVMware, Inc.None+
Source: Setup.exe, 00000009.00000002.1469637709.0000000002BA0000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1518418908.00000000007E2000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1522462580.0000000003960000.00000004.00000020.00020000.00000000.sdmp, nsnE8D9.tmp, 00000010.00000002.1518418908.00000000007F9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000003.1519565983.000002327039D000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000002.1563506695.0000023270339000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000002.2485342802.000001715D53C000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1741961146.000001715D5AE000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1583527245.000001715D5A0000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1816592248.000001715D5AE000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000012.00000003.1654496421.000001715D53C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: nsnE8D9.tmp, 00000010.00000002.1522462580.0000000003960000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.vp
Source: Setup.exe, 00000009.00000003.1370687522.0000000000513000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware%2C+Inc%2E
Source: Setup.exe, 00000009.00000002.1468425668.0000000000524000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "pc_vendor":"VMware%2C+Inc%2E",
Source: PcAppStore.exe, 0000001F.00000002.1807210933.00000223761DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW^
Source: Setup.exe, 00000009.00000002.1468425668.000000000056B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: nsnE8D9.tmp, 00000010.00000003.1495548572.0000000003970000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware%2C+Inc%2EnEG,L
Source: msedgewebview2.exe, 00000014.00000002.1599740846.000001998AA44000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000017.00000002.1574212005.000001E932E2B000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000020.00000002.1859506212.0000017DA1241000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000023.00000002.1820332621.000002257C042000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000029.00000002.2019249806.000001F158043000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 0000002C.00000002.1987530172.000002549444B000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000035.00000002.2387925975.0000022063E43000.00000004.00000020.00020000.00000000.sdmp, msedgewebview2.exe, 00000038.00000002.2343966160.000002BF3E22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Setup.exe, 00000009.00000003.1370687522.0000000000513000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.Rv

Queries a list of all running processes

Source: C:\Users\user\Downloads\Setup.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks if the current process is being debugged

Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process queried: DebugPort
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process queried: DebugPort
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process queried: DebugPort
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process queried: DebugPort
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process queried: DebugPort
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process queried: DebugPort

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Downloads\Setup.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://pcapp.store/installing.php?guid=56BB2742-D4AD-D40B-0E05-59D15B59EFED&winver=19045&version=fa.2002&nocache=20250108141848.112&_fcid=1736363911229592			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\PCAppStore\UserData\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\PCAppStore\UserData\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffd98ef8e88,0x7ffd98ef8e98,0x7ffd98ef8ea8			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=MojoIpcz /prefetch:2			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2216 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=MojoIpcz /prefetch:3			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2396 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=MojoIpcz /prefetch:8			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1736358233059789 --launch-time-ticks=5706779554 --mojo-platform-channel-handle=3392 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=MojoIpcz /prefetch:1			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\PCAppStore\UserData\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\PCAppStore\UserData\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffd98d28e88,0x7ffd98d28e98,0x7ffd98d28ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=1932 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2188 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1736358233057676 --launch-time-ticks=5731523212 --mojo-platform-channel-handle=3272 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\PCAppStore\UserData\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\PCAppStore\UserData\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x124,0x170,0x7ffda8d48e88,0x7ffda8d48e98,0x7ffda8d48ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2304 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2696 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1736358233060135 --launch-time-ticks=5747682704 --mojo-platform-channel-handle=3260 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\PCAppStore\UserData\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\PCAppStore\UserData\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffda87b8e88,0x7ffda87b8e98,0x7ffda87b8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2900 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=3324 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\PCAppStore\UserData\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1736358233059908 --launch-time-ticks=5782379095 --mojo-platform-channel-handle=3500 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=MojoIpcz /prefetch:1

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=mojoipcz --mojo-named-platform-channel-pipe=5692.364.5173740132215257085
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=c:\users\user\pcappstore\userdata\ebwebview /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\user\pcappstore\userdata\ebwebview\crashpad --annotation=isofficialbuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=win64 "--annotation=prod=edge webview2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffd98ef8e88,0x7ffd98ef8e98,0x7ffd98ef8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1792 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=mojoipcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2216 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=mojoipcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2396 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=mojoipcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1736358233059789 --launch-time-ticks=5706779554 --mojo-platform-channel-handle=3392 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=mojoipcz /prefetch:1
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=mojoipcz --mojo-named-platform-channel-pipe=6324.7232.10845545368448902965
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=c:\users\user\pcappstore\userdata\ebwebview /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\user\pcappstore\userdata\ebwebview\crashpad --annotation=isofficialbuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=win64 "--annotation=prod=edge webview2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffd98d28e88,0x7ffd98d28e98,0x7ffd98d28ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1764 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=mojoipcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=1932 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=mojoipcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2188 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=mojoipcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1736358233057676 --launch-time-ticks=5731523212 --mojo-platform-channel-handle=3272 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=mojoipcz /prefetch:1
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=mojoipcz --mojo-named-platform-channel-pipe=6316.2960.1563966726545566937
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=c:\users\user\pcappstore\userdata\ebwebview /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\user\pcappstore\userdata\ebwebview\crashpad --annotation=isofficialbuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=win64 "--annotation=prod=edge webview2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x124,0x170,0x7ffda8d48e88,0x7ffda8d48e98,0x7ffda8d48ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1772 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=mojoipcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2304 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=mojoipcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2696 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=mojoipcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1736358233060135 --launch-time-ticks=5747682704 --mojo-platform-channel-handle=3260 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=mojoipcz /prefetch:1
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=mojoipcz --mojo-named-platform-channel-pipe=7664.1756.15447033616939545645
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=c:\users\user\pcappstore\userdata\ebwebview /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\user\pcappstore\userdata\ebwebview\crashpad --annotation=isofficialbuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=win64 "--annotation=prod=edge webview2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffda87b8e88,0x7ffda87b8e98,0x7ffda87b8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1780 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=mojoipcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2900 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=mojoipcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=3324 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=mojoipcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1736358233059908 --launch-time-ticks=5782379095 --mojo-platform-channel-handle=3500 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=mojoipcz /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=c:\users\user\pcappstore\userdata\ebwebview /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\user\pcappstore\userdata\ebwebview\crashpad --annotation=isofficialbuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=win64 "--annotation=prod=edge webview2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffd98ef8e88,0x7ffd98ef8e98,0x7ffd98ef8ea8			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1792 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=mojoipcz /prefetch:2			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2216 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=mojoipcz /prefetch:3			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2396 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=mojoipcz /prefetch:8			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1736358233059789 --launch-time-ticks=5706779554 --mojo-platform-channel-handle=3392 --field-trial-handle=1776,i,16282414394967015353,10625671141425588512,262144 --enable-features=mojoipcz /prefetch:1			Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=mojoipcz --mojo-named-platform-channel-pipe=6324.7232.10845545368448902965
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=c:\users\user\pcappstore\userdata\ebwebview /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\user\pcappstore\userdata\ebwebview\crashpad --annotation=isofficialbuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=win64 "--annotation=prod=edge webview2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffd98d28e88,0x7ffd98d28e98,0x7ffd98d28ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1764 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=mojoipcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=1932 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=mojoipcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2188 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=mojoipcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1736358233057676 --launch-time-ticks=5731523212 --mojo-platform-channel-handle=3272 --field-trial-handle=1772,i,11824305629296880209,14055140428883891781,262144 --enable-features=mojoipcz /prefetch:1
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=mojoipcz --mojo-named-platform-channel-pipe=6316.2960.1563966726545566937
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=c:\users\user\pcappstore\userdata\ebwebview /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\user\pcappstore\userdata\ebwebview\crashpad --annotation=isofficialbuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=win64 "--annotation=prod=edge webview2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x124,0x170,0x7ffda8d48e88,0x7ffda8d48e98,0x7ffda8d48ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1772 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=mojoipcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2304 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=mojoipcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2696 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=mojoipcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1736358233060135 --launch-time-ticks=5747682704 --mojo-platform-channel-handle=3260 --field-trial-handle=1788,i,18426581495911839865,14364628669920248036,262144 --enable-features=mojoipcz /prefetch:1
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=mojoipcz --mojo-named-platform-channel-pipe=7664.1756.15447033616939545645
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=c:\users\user\pcappstore\userdata\ebwebview /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\user\pcappstore\userdata\ebwebview\crashpad --annotation=isofficialbuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=win64 "--annotation=prod=edge webview2" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffda87b8e88,0x7ffda87b8e98,0x7ffda87b8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1780 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=mojoipcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2900 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=mojoipcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=3324 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=mojoipcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\pcappstore\userdata\ebwebview" --webview-exe-name=pcappstore.exe --webview-exe-version=1.0.0.2002 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1736358233059908 --launch-time-ticks=5782379095 --mojo-platform-channel-handle=3500 --field-trial-handle=1788,i,16927380880539787662,8269100352561447037,262144 --enable-features=mojoipcz /prefetch:1

May try to detect the Windows Explorer process (often used for injection)

Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe.16.dr	Binary or memory string: o@C:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hShell_TrayWndWilError_03{"action":"direction_changed","data":{"direction":"%c", "withTopbar":false}}{"action":"screen_size_changed","data":{"withTopbar":false,"t":%d,"l":%d,"b":%d,"r":%d}}{"action":"locale_layout_changed","data":{"localeLayout": "%ws"}}@S.@
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1507947709.00007FF7D4A99000.00000002.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: C++/WinRT version:2.0.220110.5\\\HKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_CURRENT_CONFIGCurrentBuildBuildNumberSOFTWARE\Microsoft\Windows NT\CurrentVersionSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon%lu0e+000e+00%us%5B%5D=\uRoGetActivationFactorycombase.dllCoIncrementMTAUsagecombase.dll.dllDllGetActivationFactoryRoGetActivationFactorycombase.dllCoIncrementMTAUsagecombase.dll.dllDllGetActivationFactoryparamsnamenfinityanindsnannfinityanindtype must be string, but is snan0p+00p+0^(https?://(?:www.)?([^/]+))(/.*)?$URL format is not valid : %wsWinHTTP 1.0handle initialization failuretimeout init failurehandle connection failureGEThandle request creation failurehandle request or response failurefile creation failurequery data not availableproductr_binErreCode=%dproductcreate_shortcutshortcut_erroroid=%luSHGetFolderPath_error_code=%X&oid=%luQueryInterface_error_code=%X&oid=%luCoCreateInstance_error_code=%X&oid=%lu.lnk.lnkproductshortcut_delete_erroreC=%Xinfnan(ind)nannan(snan)infnan(ind)nannan(snan)infnan(ind)nannan(snan)Shell_TrayWndinfnan(ind)nannan(snan)infnan(ind)nannan(snan)infnan(ind)nannan(snan)type must be string, but is unknownmenu_storemenu_searchhttps://pcapp.store%02Xunknown\/LTRRTLLTRSoftware\PCAppStoreAppParamdefaultbad allocation
Source: PcAppStore.exe, 00000011.00000000.1507947709.00007FF7D4A99000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: o@C:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hShell_TrayWndWilError_03{"action":"direction_changed","data":{"direction":"%c", "withTopbar":false}}{"action":"screen_size_changed","data":{"withTopbar":false,"t":%d,"l":%d,"b":%d,"r":%d}}{"action":"locale_layout_changed","data":{"localeLayout": "%ws"}}@S
Source: nsnE8D9.tmp, 00000010.00000002.1519358324.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000011.00000000.1507947709.00007FF7D4A99000.00000002.00000001.01000000.00000014.sdmp, PcAppStore.exe.16.dr	Binary or memory string: C:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hC:\Build\Build_2002_D20241129T170824\fa_rss\engine\packages\Microsoft.Windows.ImplementationLibrary.1.0.240803.1\include\wil\resource.hCoInitialize+Init+FailedCoCreateInstance+CLSID_AppVisibility+IID_IAppVisibilitymenu_searchshowclosepage=aopen_searchIAppVisibility+IsLauncherVisibleWilError_03SearchWindows.UI.Core.CoreWindowSearchHost.exeSearchApp.exeSearchButtonToggleButtonShell_SecondaryTrayWndShell_TrayWnd

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\Trust Protection Lists\manifest.json VolumeInformation			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\WidevineCdm\manifest.json VolumeInformation			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Network\SCT Auditing Pending Reports VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Local State VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Variations VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Last Version VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Preferences VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Secure Preferences VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\WidevineCdm\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\Trust Protection Lists\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Network\Sdch Dictionaries VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Network\Network Persistent State VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Network\SCT Auditing Pending Reports VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Local State VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Variations VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Last Version VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Preferences VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Secure Preferences VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\WidevineCdm\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\Trust Protection Lists\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Network\Sdch Dictionaries VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Network\Network Persistent State VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Network\SCT Auditing Pending Reports VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Local State VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Variations VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Last Version VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Preferences VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Secure Preferences VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\Trust Protection Lists\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\WidevineCdm\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Network\Sdch Dictionaries VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Network\Network Persistent State VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\PCAppStore\UserData\EBWebView\Default\Network\SCT Auditing Pending Reports VolumeInformation

Lowering of HIPS / PFW / Operating System Security Settings

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\nsnE8D9.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct