24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 62:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample 2b82e968c7dc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2b82e968c7dc…. Malware family: Zusy.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d"],"about":{"@type":"SoftwareApplication","name":"bounty-98991780990718275","applicationCategory":["peexe","executable"],"identifier":"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tdac,"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\ALLPROTOCOLS") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\TREATAS") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\TREATAS") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\INPROCSERVER32") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\INPROCSERVER32") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\INPROCHANDLER32") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\INPROCHANDLER32") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\INPROCHANDLER") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\INPROCHANDLER") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\LOCALSERVER32") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\LOCALSERVER32") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\LOCALSERVER") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\LOCALSERVER") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\ELEVATION") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\ELEVATION") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\ELEVATION") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\ELEVATION") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\STRINGCACHESETTINGS")26:T62a,"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" queried SystemProcessInformation at 00000000-00004304-00000C15-2347425199 [PID: 4304] "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" queried SystemProcessInformation at 00000000-00004304-00000C15-2347436805 [PID: 4304] "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" queried SystemProcessInformation at 00000000-00004304-00000C15-2347673400 [PID: 4304] "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" queried SystemProcessInformation at 00000000-00004304-00000C15-2347682442 [PID: 4304] "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" queried SystemProcessInformation at 00000000-00004304-00000C15-2355585335 [PID: 4304] "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" queried SystemProcessInformation at 00000000-00004304-00000C15-2355593017 [PID: 4304] "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" queried SystemProcessInformation at 00000000-00004304-00000C15-2355795962 [PID: 4304] "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" queried SystemProcessInformation at 00000000-00004304-00000C15-2355804652 [PID: 4304] "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" queried SystemProcessInformation at 00000000-00004304-00000C15-2355944853 [PID: 4304] "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" queried SystemProcessInformation at 00000000-00004304-00000C15-2355952582 [PID: 4304]27:T1056,Found XOR loop in file "sample.bin" at offset 569195; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 619013; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 651782; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 683773; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 692792; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 724813; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 812694; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 838165; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 891225; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 946689; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1114491; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1135130; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1163122; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1248949; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1314112; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1406812; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1472057; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1501938; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1660634; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1699154; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 12611; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 13232; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 614651; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 627754; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 685129; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 719353; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 780232; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 802130; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 941590; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 992286; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1032603; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1054131; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1137328; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1179723; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1342880; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1401304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1500753; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 279534; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 522461; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 565198; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 625044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 651159; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 671291; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 702550; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 712590; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 729831; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 820244; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 836577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 974716; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1059347; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1181971; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1479899; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1486420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1536080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1724246; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1726975; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1727222; code bytes = 803028:Td6e,"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000084720000090300000000780e09036ceed9006c428472780e09030000000078eed9002a0b8472780e0903dceed9009ff78372780e0903170000009e292d77d8b80a030000000038000000340000000000090350efd900dceed900230000002700000000003f003f005c00d007dc004000000000000000110000000000dc00c44e8272ef74d900c039857201000000f0b20a03f0b209031700000000000000200000000000dc00d801dc007c0cdc0000000000780cdc000500000048efd90050f52c77d8b80a03b0efd900fcefd90000000903b8b2090350f52c77d8b80a0300007472feffffffa80bdc00e0b2090300000000000000000000747250efd900 (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004304)29:T656,"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTP"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTP"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "")2a:Tdb7,"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\MUI\0409\\mscoreeis.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreeis.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00004304)2b:T3898,"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter GetUrlCacheEntryBinaryBlob (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004304)2c:T2ba9,Found reference to API (Indicator: "RegDeleteKeyA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetStockObject"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "DeleteObject"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "SelectObject"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "CreateFontIndirectA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetObjectA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "WaitForSingleObject"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "RaiseException"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetCPInfo"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "TerminateProcess"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "LCMapStringW"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetProcAddress"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "RtlUnwind"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "InterlockedDecrement"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetLastError"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "WideCharToMultiByte"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetFileType"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "ExitProcess"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "TlsAlloc"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "SetHandleCount"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetCurrentProcessId"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetModuleHandleA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetStartupInfoA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "IsDebuggerPresent"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "DeleteCriticalSection"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetModuleHandleW"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetLocaleInfoA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "Sleep"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "WriteFile"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetACP"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetStringTypeW"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "VirtualAlloc"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "HeapSize"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "InterlockedIncrement"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetTickCount"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "TlsFree"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "HeapCreate"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "HeapFree"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "FreeConsole"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "CreateThread"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "TlsSetValue"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetStringTypeA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "VirtualFree"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetCurrentThreadId"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetCommandLineA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "HeapAlloc"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "LoadLibraryA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "IsValidCodePage"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "LeaveCriticalSection"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetCurrentProcess"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "lstrlenW"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "TlsGetValue"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "HeapReAlloc"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "LCMapStringA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetOEMCP"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetModuleFileNameA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "MultiByteToWideChar"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "VirtualProtect"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "SetLastError"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetStdHandle"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "EnterCriticalSection"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "wsprintfA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetActiveWindow"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetClassInfoA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "SetWindowTextA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "LoadCursorA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "CallWindowProcA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "SetWindowLongA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "MessageBoxA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "EncodePointer"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "DecodePointer"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "FlsFree"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "FlsSetValue"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "FlsGetValue"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "FlsAlloc"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetProcessWindowStation"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API (Indicator: "GetLastActivePopup"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d")2d:T13f3,"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74a90000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74a90000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74a90000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "KERNEL32" at base 75d90000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 727a0000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "MSCOREE.DLL" at base 72740000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "ADVAPI32.DLL" at base 749b0000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 726b0000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "SHLWAPI.DLL" at base 74420000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 749a0000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEIS.DLL" at base 4ee0000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "USER32.DLL" at base 74710000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "COMCTL32.DLL" at base 72880000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "USER32" at base 74710000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73760000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "KERNEL32.DLL" at base 75d90000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 73cd0000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75c90000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "OLEAUT32.DLL" at base 74090000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "RPCRT4.DLL" at base 74650000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74710000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74710000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 75280000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "SHELL32.DLL" at base 75e60000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 71fb0000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75d90000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.SHELL.SERVICEHOSTBUILDER.DLL" at base 71f90000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "COMCTL32.DLL" at base 72ef0000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 71420000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "PROPSYS.DLL" at base 731d0000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 731d0000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75280000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "SECUR32.DLL" at base 71390000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "SSPICLI.DLL" at base 73cb0000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "MLANG.DLL" at base 71350000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 73ef0000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "WININET.DLL" at base 71080000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74c90000 "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" loaded module "NTDLL.DLL" at base 772900002e:T6db,"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" touched "Query file associations" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A07034FD-6CAA-4954-AC3F-97A27216F98A}\INPROCSERVER32") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" touched "Internet Shortcut" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" touched "File Property Page Extension" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{21B22460-3AEA-1069-A2DC-08002B30309D}\INPROCSERVER32") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" touched "Microsoft Url History Service" (Path: "HKCU\WOW6432NODE\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS")2f:T1b3e,Process "msedge.exe" (UID: 00000000-00006224) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", USERDNSDOMAIN="DESKTOP-FVVF82A", FPS_BROWSER_USER_PROFILE_STRING="Default", PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00006224) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles, NUMBER_OF_PROCESSORS" Process "msedge.exe" (UID: 00000000-00006136) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_6224_KAXDCLPVYNLSUYPW", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="6224"" Process "msedge.exe" (UID: 00000000-00006136) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00006136) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00003908) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00002636) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CURL_CA_BUNDLE, FPS_BROWSER_USER_PROFILE_STRING, PATHEXT, ProgramData, ProgramW6432, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, windir, USERDOMAIN, FPS_BROWSER_APP_PROFILE_STRING, LOGONSERVER, OneDrive, APPDATA, CommonProgramFiles, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, HOMEDRIVE, USERPROFILE, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007528) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="s4wASshPpJc6mSC", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="x86", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="Df48Ohj", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\(x86)\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", FPS_BROWSER_USER_PROFILE_STRING="Default", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", PROCESSOR_ARCHITEW6432="AMD64", COMPUTERNAME="s4wASshPpJc6mSC", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\Df48Ohj", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\Df48Ohj", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="%PROGRAMFILES%\(x86)", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="8", windir="C:\WINDOWS"" Process "msedge.exe" (UID: 00000000-00007528) was launched with missing environment variables: "EDGE_CRASHPAD_PIPE_NAME, COMPONENT_INSTALLER_DIR, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007552) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_6224_KAXDCLPVYNLSUYPW", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="6224"" Process "msedge.exe" (UID: 00000000-00007552) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, FPS_BROWSER_APP_PROFILE_STRING, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, FPS_BROWSER_USER_PROFILE_STRING, PATHEXT, OS, PROCESSOR_ARCHITEW6432, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "msedge.exe" (UID: 00000000-00005056) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="Df48Ohj", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", FPS_BROWSER_USER_PROFILE_STRING="Default", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\Df48Ohj", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", windir="C:\WINDOWS", USERDOMAIN="s4wASshPpJc6mSC", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", LOGONSERVER="%HOSTNAME%", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", CommonProgramFiles="%PROGRAMFILES%\Common Files", OS="Windows_NT", COMPUTERNAME="s4wASshPpJc6mSC", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", HOMEDRIVE="C:", USERPROFILE="C:\Users\Df48Ohj", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", NUMBER_OF_PROCESSORS="8", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00001720) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CURL_CA_BUNDLE, FPS_BROWSER_USER_PROFILE_STRING, PATHEXT, ProgramData, ProgramW6432, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, windir, USERDOMAIN, FPS_BROWSER_APP_PROFILE_STRING, LOGONSERVER, OneDrive, APPDATA, CommonProgramFiles, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, HOMEDRIVE, USERPROFILE, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS, EDGE_METRICS_CLIENT_ID_HASH"30:Ta0c,Spawned process "msedge.exe" with commandline "--single-argument http://go.microsoft.com/fwlink/?prd=11324&pver ..." (UID: 00000000-00006224) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006136), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003908), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00005712), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002636), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00004764), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007780), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00003812), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00006140), Spawned process "msedge.exe" with commandline "--single-argument http://go.microsoft.com/fwlink/?prd=11324&pver ..." (UID: 00000000-00007528), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --disable-gpu-compositing - ..." (UID: 00000000-00007552), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --disable-gpu-compositing - ..." (UID: 00000000-00007484), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --disable-gpu-compositing - ..." (UID: 00000000-00003500), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00005056), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00001860), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001720), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00008156), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00004944)31:Ta0c,Spawned process "msedge.exe" with commandline "--single-argument http://go.microsoft.com/fwlink/?prd=11324&pver ..." (UID: 00000000-00006224) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006136), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003908), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00005712), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002636), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00004764), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007780), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00003812), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00006140), Spawned process "msedge.exe" with commandline "--single-argument http://go.microsoft.com/fwlink/?prd=11324&pver ..." (UID: 00000000-00007528), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --disable-gpu-compositing - ..." (UID: 00000000-00007552), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --disable-gpu-compositing - ..." (UID: 00000000-00007484), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --disable-gpu-compositing - ..." (UID: 00000000-00003500), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00005056), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00001860), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001720), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00008156), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00004944)32:Tb63,The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 ECC CA OCSP 02, O=Microsoft Corporation, C=US" (SHA1: A4:A3:1D:42:DB:F5:25:6D:AF:13:1E:DA:BD:AF:8A:39:96:4C:CA:B5; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS ECC Root G2, O=Microsoft Corporation, C=US" (SHA1: 33:6D:3E:54:51:31:52:94:F6:E1:E7:CF:DA:84:E5:1C:8B:1E:40:54; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7F:A0:5A:CF:9B:4A:AB:B0:DE:0C:FA:FA:29:7D:DF:92:FD:C5:F3:F5; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 04, O=Microsoft Corporation, C=US" (SHA1: 6A:EF:17:AE:5C:78:07:D9:A4:3A:F9:EC:41:25:32:CB:58:F6:E8:87; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: DA:6D:04:00:64:1B:45:AE:CC:59:5D:24:E5:03:7A:A6:BC:09:C3:58; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: A0:20:9F:E4:EB:B9:7E:2F:51:C6:BD:BB:AF:02:44:35:C1:8D:84:74; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert Inc.", C=US" (SHA1: AD:50:22:04:99:F1:2C:55:3C:03:F7:B4:C1:72:39:2D:B8:FC:73:7B; see report for more information)33:T960,"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")34:Teba,"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "2B82E968C7DC0B4726ACB9EAD06092A059FBF34E9068532AD1151C479E5B331D.EXE"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")35:T5a7,"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to touch file "C:\2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to touch file "C:\2B82E968C7DC0B4726ACB9EAD06092A059FBF34E9068532AD1151C479E5B331D.EXE.LOCAL" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll"36:Tb8e,"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\FLTLIB.DLL" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\MSCOREE.DLL" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\mscoree.dll" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MUI\0409\MSCOREEIS.DLL" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MUI\0409\mscoreeis.dll" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\PROPSYS.DLL" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\PROPSYS.dll" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\URLMON.DLL" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\urlmon.dll" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\iertutil.dll" "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" trying to access non-existent file "C:\EDPUTIL.DLL"37:T8e8,Found http requests in header "GET /dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0" Found http requests in header "GET /en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0" Found http requests in header "GET /static/assets/0.4.03427.7856-752ce836/styles/site.css" Found http requests in header "GET /_themes/docs.theme/master/en-us/_themes/global/deprecation.js" Found http requests in header "GET /static/assets/0.4.03427.7856-752ce836/scripts/en-us/index-docs.js" Found http requests in header "GET /en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png" Found http requests in header "GET /en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started-details.png" Found http requests in header "GET /en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png" Found http requests in header "GET /en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png" Found http requests in header "GET /en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png" Found http requests in header "GET /akam/13/174b2aa4" Found http requests in header "POST /api/recommendations/b8aa5a1c-2f8d-db8d-1dfb-d6da8ce4f66f/batch" Found http requests in header "GET /static/assets/0.4.03427.7856-752ce836/styles/docons.752ce83.7a2010b1.woff2" Found http requests in header "GET /en-us/content-nav/site-header/site-header.json?" Found http requests in header "GET /en-us/content-nav/MSDocsHeader-DotNet.json?" Found http requests in header "GET /en-us/feature-rollout.json" Found http requests in header "GET /en-us/dotnet/framework/toc.json" Found http requests in header "GET /en-us/dotnet/breadcrumb/toc.json" Found http requests in header "GET /en-us/banners/index.json" Found http requests in header "POST /akam/13/pixel_174b2aa4" Found http requests in header "GET /api/taxonomies?name=devlang&locale=en-us"38:T677,Pattern match: "gomicrosoft.com/fwlink/?prd" Heuristic match: "a.net" Pattern match: "learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?versior" Heuristic match: "fix.net" Pattern match: "http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0" Heuristic match: "e, ultricies lorem. cras risus justo, aliquet eget faucibus vel, tincidunt eget neque. fusce porttitor ipsum quis aliquam suscipit.etiam sit amet ligula lorem. suspendisse bibendum rhoncus ultrices. in ultrices quam ut nunc luctus malesuada. in vulputate, " Pattern match: "https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processname=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0accept-encoding" Pattern match: "https://learn.microsoft.comx-edge-shopping-flag" Pattern match: "https://learn.microsoft.comsec-ch-ua-platform" Pattern match: "https://learn.microsoft.com/static/assets/0.4.03427.7856-752ce836/styles/site.cssaccept-encoding" Heuristic match: "js.monitor.azure.com" Heuristic match: "edgeassetservice.azureedge.net" Pattern match: "www.googleapis.com" Heuristic match: "edge-consumer-static.azureedge.net" Pattern match: "http://go.microsoft.com/fwlink/?prd=11324&pver=4" Pattern match: "http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=2"39:T9a62,GET /dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept: text/html application/xhtml+xml application/xml;q=0.9 image/avif image/webp image/apng */*;q=0.8 application/signed-exchange;v=b3;q=0.7 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "5.0.0" Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959 GET /en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept: text/html application/xhtml+xml application/xml;q=0.9 image/avif image/webp image/apng */*;q=0.8 application/signed-exchange;v=b3;q=0.7 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "5.0.0" Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959 GET /static/assets/0.4.03427.7856-752ce836/styles/site.css HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css */*;q=0.1 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A== GET /dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept: text/html application/xhtml+xml application/xml;q=0.9 image/avif image/webp image/apng */*;q=0.8 application/signed-exchange;v=b3;q=0.7 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "5.0.0" Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A== GET /_themes/docs.theme/master/en-us/_themes/global/deprecation.js HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A== GET /static/assets/0.4.03427.7856-752ce836/scripts/en-us/index-docs.js HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A== GET /_themes/docs.theme/master/en-us/_themes/global/deprecation.js HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A== If-None-Match: W/"598-19e47e08cd8" If-Modified-Since: Thu 21 May 2026 00:12:39 GMT GET /en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A== GET /en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started-details.png HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A== GET /en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A== GET /en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A== GET /en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A== GET /akam/13/174b2aa4 HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A== GET /static/assets/0.4.03427.7856-752ce836/styles/docons.752ce83.7a2010b1.woff2 HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive Origin: https://learn.microsoft.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://learn.microsoft.com/static/assets/0.4.03427.7856-752ce836/styles/site.css Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D GET /en-us/content-nav/site-header/site-header.json? HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A== GET /en-us/content-nav/MSDocsHeader-DotNet.json? HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D GET /en-us/feature-rollout.json HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D GET /en-us/dotnet/framework/toc.json HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D GET /en-us/dotnet/breadcrumb/toc.json HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D GET /en-us/banners/index.json HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF6mVLUKeAQAAfE7cYh/p8rSRQmfoD+nMarRTaxsM+z0xBTAGYjyXCmyWFgmjPqrKrEgwcAJc4PkYl08AV/0+qUIz4QpEbyCsxRQUPff9WBjc90o0ICoyTrQGEuI+OWYaNZWaV485wLkzscWYomZsw3V5GPdrHNCoD4qkvl8HDWGzXvLpFQcc73psBGhteEEGfsrlyrqzjU6DQN+sj/mGBJSlCxPB+NmaAHGdp2ofGxWlUZ+qYE/gc+bfb2mJqBdNiFuaPo1oiBJVpAl7VzR4cHR/MeZuZC9ylThVxKePsl9auYzsqk+rEI7luZ8h7YhQVm78wZZav7e8ps+s++qPwKkAXs9TFSf/G5XPMMQi3MbS6biXXK5c8L0ElcxBXLzJiYpjuy3bR30rm5SS9mTIOyVg4F2Jm8qDfYuu2w== GET /akam/13/174b2aa4 HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A== If-None-Match: "a0a1b699185401c25941d4ec2426b17fe72aa5c19bd56a5d4be10f7d33c17d95" If-Modified-Since: Thu 22 Feb 2024 19:50:30 GMT GET /api/taxonomies?name=devlang&locale=en-us HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF6mVLUKeAQAAfE7cYh/p8rSRQmfoD+nMarRTaxsM+z0xBTAGYjyXCmyWFgmjPqrKrEgwcAJc4PkYl08AV/0+qUIz4QpEbyCsxRQUPff9WBjc90o0ICoyTrQGEuI+OWYaNZWaV485wLkzscWYomZsw3V5GPdrHNCoD4qkvl8HDWGzXvLpFQcc73psBGhteEEGfsrlyrqzjU6DQN+sj/mGBJSlCxPB+NmaAHGdp2ofGxWlUZ+qYE/gc+bfb2mJqBdNiFuaPo1oiBJVpAl7VzR4cHR/MeZuZC9ylThVxKePsl9auYzsqk+rEI7luZ8h7YhQVm78wZZav7e8ps+s++qPwKkAXs9TFSf/G5XPMMQi3MbS6biXXK5c8L0ElcxBXLzJiYpjuy3bR30rm5SS9mTIOyVg4F2Jm8qDfYuu2w==; MicrosoftApplicationsTelemetryDeviceId=63c46548-3737-44bf-ab23-99ccefd44c35; ai_session=F7XXjzbaotMtPffipJl+Q6|1779775066180|1779775066180; bm_sv=53BF3E21F9804611047A0769F5256F91~YAAQxgPXF9yVLUKeAQAAO1HcYh+H+4FrjWBzeMjYZ0Mon3JlJ1ksdq86HszqZ8blWcWyOzooDBr+d1F9SBK+gjWasNKKkDg/2+sHVvaNowaNfzwQHHVb2FZtLLdRA8QZb558t8TxBGXEHkt0LZMnw83eHczuV/IPZy3fIspqk2KP95MVevXdWGZrZLJS4U5toVFYk05bYUHZZJ5937NOC651e8OY4yZgx6zGSLMaGEgJLbo3MhBICzAgJnZ/36sycgcs~1 GET /media/logos/logo_net.svg HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF6mVLUKeAQAAfE7cYh/p8rSRQmfoD+nMarRTaxsM+z0xBTAGYjyXCmyWFgmjPqrKrEgwcAJc4PkYl08AV/0+qUIz4QpEbyCsxRQUPff9WBjc90o0ICoyTrQGEuI+OWYaNZWaV485wLkzscWYomZsw3V5GPdrHNCoD4qkvl8HDWGzXvLpFQcc73psBGhteEEGfsrlyrqzjU6DQN+sj/mGBJSlCxPB+NmaAHGdp2ofGxWlUZ+qYE/gc+bfb2mJqBdNiFuaPo1oiBJVpAl7VzR4cHR/MeZuZC9ylThVxKePsl9auYzsqk+rEI7luZ8h7YhQVm78wZZav7e8ps+s++qPwKkAXs9TFSf/G5XPMMQi3MbS6biXXK5c8L0ElcxBXLzJiYpjuy3bR30rm5SS9mTIOyVg4F2Jm8qDfYuu2w==; MicrosoftApplicationsTelemetryDeviceId=63c46548-3737-44bf-ab23-99ccefd44c35; ai_session=F7XXjzbaotMtPffipJl+Q6|1779775066180|1779775066180; bm_sv=53BF3E21F9804611047A0769F5256F91~YAAQxgPXF9yVLUKeAQAAO1HcYh+H+4FrjWBzeMjYZ0Mon3JlJ1ksdq86HszqZ8blWcWyOzooDBr+d1F9SBK+gjWasNKKkDg/2+sHVvaNowaNfzwQHHVb2FZtLLdRA8QZb558t8TxBGXEHkt0LZMnw83eHczuV/IPZy3fIspqk2KP95MVevXdWGZrZLJS4U5toVFYk05bYUHZZJ5937NOC651e8OY4yZgx6zGSLMaGEgJLbo3MhBICzAgJnZ/36sycgcs~1 GET /en-us/media/event-banners/banner-build-2026.png HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/static/assets/0.4.03427.7856-752ce836/styles/site.css Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; MicrosoftApplicationsTelemetryDeviceId=63c46548-3737-44bf-ab23-99ccefd44c35; ai_session=F7XXjzbaotMtPffipJl+Q6|1779775066180|1779775066180; bm_sv=8F581D2E30100645B93B7803DB9C9B7A~YAAQxgPXF/OVLUKeAQAAoVLcYh9B+TUsL+wAQotX2jdhyjpsZpxjjdQqCIteRMhSnHsE0jt19/T0e9dIoNptovx0uNSpqmP4iyoov9xs2HXtGdT1eR+/leLHx4LPO5B+URFVaFkGck4/05YyiC9An8T5O5T+UQ7KLkSJNCShrGT76iABRgiO6Spghzz8EpD8QzI24zACg34IlmBHYpan0zsVoGl0pJmpFrwct/L4C7V7DToV00+rC/n3tR1M3fbet+qE~1; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF1GWLUKeAQAAMFfcYh8GRc84bhgUkqo86TYvfe/udy1aaSkg1X6+imYwnBCWFkti2J32+sZvEJvgx6QdejTHkazVdCeucMvenJN5XzHSkCoTbmPBxAO18R34WdcXWf6qKH+ln4nw5CIsGlEdwCwt/MBLAlnHCp4OV7YJYCtz0ohExiaYKEi1rIoi9dIVyN4ZYfkhqU0NAfYnirA6iCQNC8RHJkAptdbQPI2ohYiGLLYUIq5BywZNlBDwhRstfb9LcERsm0qVDiwmnngZmjbT117CV4FlnJnVoz5ZkE43OxkePRWe34WQd5EZh2uRhMjJX/ntiHGjCR2VSYjwevUe27aCNtQpnJuyVRk2rOZugh5E0jJSdBf0dnin0ccsAZX+JcoVMqm6ILL2MYyWh5w4qr6rBFuksd0INKavu68qViRobTbJhcWBWQRI+/WjeqLC6FFX GET /static/third-party/MathJax/3.2.2/tex-mml-chtml.js HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive Origin: https://learn.microsoft.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; MicrosoftApplicationsTelemetryDeviceId=63c46548-3737-44bf-ab23-99ccefd44c35; ai_session=F7XXjzbaotMtPffipJl+Q6|1779775066180|1779775066180; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF2iWLUKeAQAA41fcYh++5Maz6EdOF38Od+ySLdpU96rQa/cqgPIg+FReReQwxxQ8AVAdwyjLYAvDJy20nRqNvzspfUBzQpTXGZQHOcUDls2QrciyStwGS4XMYoGbjmbxOvoytVWs3gimmHwYwaGWtdngcqx4tjYx3y9zTtlMb2JR/ihxsHRHK3TWqbX+M2DBNUlXg46MmRhYrhxpv9Z8u3hHBJSSrg4LqQn79zC5atTgRoS5103Jkydq1eQcku31UpmgvvuvF4QRuOLTfn/RXc9804eZt9xQDDmxNqyTrcMGSKuq7FvOT56ApJpX6MdO2ARpOKHiJnM+DLbd9e5+xAiwnagWHHtaF2xXb+lF7Ac8rA3CfTxXo3nwlhJH9Zc9vxabG1FnKmiLgAGxJxH9ZFXLpr9jtUlUVmv3Cx0T9l8B7R54FTllDIm/ckw=; bm_sv=53BF3E21F9804611047A0769F5256F91~YAAQxgPXF2mWLUKeAQAA41fcYh97lg/8Y/lsfQDIvnlDU3saJrtBRMmCL0kDKeLv2/RZUFs8I3CD0It+iNDEw7M2mzogywAdvc+HE+PgCcFdswl/0+H4J608J5n9Rj2getRzAbqsDDhsnvN27u6JCPe1gHc8Jk+gLkSsxzVuceG5+m5EE+7D6NI1CnbpwkZEGsJMWt/GHRswNkcZKf5OR0TIdKGOgXkiNvCv1y6+mV0QAYi+7a5LTu+vXoE7LcGPxPvm~1 3a:Ta62,Found HTTPS GET request to https://learn.microsoft.com/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Found HTTPS GET request to https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Found HTTPS GET request to https://learn.microsoft.com/static/assets/0.4.03427.7856-752ce836/styles/site.css Found HTTPS GET request to https://learn.microsoft.com/_themes/docs.theme/master/en-us/_themes/global/deprecation.js Found HTTPS GET request to https://learn.microsoft.com/static/assets/0.4.03427.7856-752ce836/scripts/en-us/index-docs.js Found HTTPS GET request to https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png Found HTTPS GET request to https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started-details.png Found HTTPS GET request to https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png Found HTTPS GET request to https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png Found HTTPS GET request to https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png Found HTTPS GET request to https://learn.microsoft.com/akam/13/174b2aa4 Found HTTPS POST request to https://learn.microsoft.com/api/recommendations/b8aa5a1c-2f8d-db8d-1dfb-d6da8ce4f66f/batch Found HTTPS GET request to https://learn.microsoft.com/static/assets/0.4.03427.7856-752ce836/styles/docons.752ce83.7a2010b1.woff2 Found HTTPS GET request to https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json? Found HTTPS GET request to https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json? Found HTTPS GET request to https://learn.microsoft.com/en-us/feature-rollout.json Found HTTPS GET request to https://learn.microsoft.com/en-us/dotnet/framework/toc.json Found HTTPS GET request to https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json Found HTTPS GET request to https://learn.microsoft.com/en-us/banners/index.json Found HTTPS POST request to https://learn.microsoft.com/akam/13/pixel_174b2aa4 Found HTTPS GET request to https://learn.microsoft.com/api/taxonomies?name=devlang&locale=en-us3b:T876,"POST /akam/13/pixel_174b2aa4 HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive Content-Length: 3579 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 Accept: */* Origin: https://learn.microsoft.com X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; MicrosoftApplicationsTelemetryDeviceId=63c46548-3737-44bf-ab23-99ccefd44c35; bm_sv=53BF3E21F9804611047A0769F5256F91~YAAQxgPXF2mWLUKeAQAA41fcYh97lg/8Y/lsfQDIvnlDU3saJrtBRMmCL0kDKeLv2/RZUFs8I3CD0It+iNDEw7M2mzogywAdvc+HE+PgCcFdswl/0+H4J608J5n9Rj2getRzAbqsDDhsnvN27u6JCPe1gHc8Jk+gLkSsxzVuceG5+m5EE+7D6NI1CnbpwkZEGsJMWt/GHRswNkcZKf5OR0TIdKGOgXkiNvCv1y6+mV0QAYi+7a5LTu+vXoE7LcGPxPvm~1; ai_session=F7XXjzbaotMtPffipJl+Q6|1779775066180|1779775068844; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF5qWLUKeAQAA1FrcYh8MyL9x2dy40rmWa3jX79nRF3avmaAxywbV1E6n9kWa9DIjqGQOazKA458LPutzKpfLHvL+ue2ijLWjJWy4fsCXUXuhDg44Nu+xCm1eLkGsEFEf8+haOBeP680J6ymuoaceEqe3+QbnxXI2x90Lf5+aGKaF8ugy5w2Ak5Wny3YFBgjck8T7UkPoBmXvsfiInblh9vyV2IT6RkgZzAtzhzRcXSzSPqBfm6xtDmLBaoo34uwXbQ14tLUfa0oF2UE1+8MR3w1P5AdbQiA11XAeMW7TbJj5VwBEw8EhF5mGBkjt4NEKwrzR1TdKbzzzO9+pnOL1dpx7SATm5FKgyr+KdJgUtX7aaEdHU+L8z62mpamBtC0QMyGR6m1MMnMllIU24OcegTe0lFw4I1/D0pm1a8gBiwRb55Cl++FBBeFD3Us="3c:Teac,"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00004304) "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004304)3d:Tcb2,"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "FCB4228CD4ECDC010000000000000000000000000200000000"), "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "E220000000000000040004000100010001010000F1D9A3007900020000000571AE000708B8000C14B5000C3584000D7879000DA18100158AA20015E17A0016277B0016DDA400174B73001B4278001BF60B001C955C001DA16C001E8D52001F4EA8001F5D7A001FF77B0021777A00244BAB0024ACC700259960002989DF002A68A9002B2499002C3D810032D1A70036AC52003CB352003E33830041A8760042264A0048C24F0049E57D0049EAB7004AA710004AAA81004EBF72004F85B50053CE8400560A85005A5EB5006041AE00682C900069C3A3006B767D006F0B6D00726E4A007477AD0075A37E007814B00078EF6400799C39007CF788007FD189008106950081515D008227730083F1600084E683008550AE0087DE83008A8093008B5188008C0E7B008E78A20090F7AF00936DAD0093866100959B5100976AB60097748D00978EAB009BE07A009D9D9200A2050600A6D69A00A736A800A7B8AD00A90DAE00B1CE9800B3F1A200B79C1400BB8E8B00BBAE7E00BCFA8D00BD539800BE0CAC00C0CC9900C36D8100C4114C00C8464E00C9389700CC495600CDBD8C00CFC29400D0175600D0725B00D08EAB00D19A7B00D1D2A700D3826100D3E88D00DAFF0E00DB6EA100E1C97700E21B5600E42A5E00E7997F00EBBF8400EEE17D00F17D5F00F1D9A300F1FC6000F548B100F7125E00F7D36F00F7ED6A00F8FE8200F9778C005A000600000003CC910007B3AD000858710009EF7D000BFF5C000E4D7E000FBA9E00110FAA001319830013B7B10013E9780016F0B20017349B001786A70019C398001C4452001D97A90022D38900316DBB003256AE0032E9830036A6AC00395EA700427F7A004293800042B3AE0042C46A0042FA5800472471004C41B4004CA770004EA059004F0CAC00508FC4005CE17D00624F980066E7820069D281006B0961006E7B8C007140A300723C120072B29F0073CD610073D3A700757C860076418E0085CAA90091508A0091D3A30093168900938EAB0098B9A40099698A009CE0A8009D9FA0009F60C3009F8F6E00A02AAB00A18EAB00A1D7B300A3F76A00A522A400A58F6000A644A600A9A4C200AA1BAA00B6515D00BA146500BC88B100BC8AA700BD388F00BE558200C176B300C33EA300C456A100CC4BA700D0FE6200D1589600D6B79A00D93DAA00DC38AB00DE3D8300E17E8C00E98AA700EAB94F00EC9FBB00ED0CAD00F4AD7A00FE208B000400400100000571AE006041AE00682C9000F1D9A300010043010000C0EC7C0000")3e:T47d,Found string "FlsFree" (Source: 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d, API is part of module: KERNELBASE.DLL) Found string "CorExitProcess" (Source: 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d, API is part of module: MSCOREEI.DLL) Found string "GetProcessWindowStation" (Source: 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d, API is part of module: USER32.DLL) Found string "GetUserObjectInformationA" (Source: 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d, API is part of module: USER32.DLL) Found string "GetLastActivePopup" (Source: 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d, API is part of module: USER32.DLL)3f:T54a7,"POST /api/recommendations/b8aa5a1c-2f8d-db8d-1dfb-d6da8ce4f66f/batch HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive Content-Length: 258 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Content-Type: application/json sec-ch-ua-mobile: ?0 Accept: */* Origin: https://learn.microsoft.com X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==" with payload::==> "{"locale":"en-us","documentId":"c89966aa-b155-c98a-2391-47e01d468236","requests":[{"modelName":"TrainingRelated","take":1},{"modelName":"CertificationRelated","take":1},{"modelName":"Personalization","visitorId":"1f0d2d8726514c9d973d49400b3b6479","take":8}]}" HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://learn.microsoft.com Content-Encoding: gzip Vary: Origin Accept-Encoding Request-Context: appId=cid-v1:8da7faac-355b-4ce1-beec-f624ec5c6263 X-ms-Operation-Id: e06b72b71035bf2c8e99359920a7699d X-Content-Type-Options: nosniff x-azure-ref: 20260526T055745Z-175bc444c792vpc5hC1STOant80000000u2g0000000055cm nel: {"report_to":"network-errors" "max_age":604800 "success_fraction":0.01 "failure_fraction":1.0} report-to: {"group":"network-errors" "max_age":604800 "endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]} Content-Length: 413 Cache-Control: public max-age=43200 Expires: Tue 26 May 2026 17:57:46 GMT Date: Tue 26 May 2026 05:57:46 GMT Connection: keep-alive Akamai-Cache-Status: Miss from child NotCacheable from parent Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Set-Cookie: bm_sv=A9DF8A43A13ECC0215762BC2632AF205~YAAQxgPXF8mVLUKeAQAAzlDcYh8zg7BF6Uy/zuvFdJwbOylUY5gtUZg9ALjNo3fmVHxelKblswjFknM4B/Eol/q8Jgc0fY3sv+N9U9TO3Qc6KvPnwhp4ChYHiOLQ7S3iZQ3D3++icJCQIWO5skH+So03UwnaQXfsoDM2UxXm6wkxtDKQy/U29n+WRx4AZCQQPwJR3jsnszsyi9/GCtibvrTpkHxi58RYaL9nbjjxxObwaKKw6sPodsMaeKcRO7O1PVM4~1; Domain=.microsoft.com; Path=/; Expires=Tue 26 May 2026 07:57:46 GMT; Max-Age=7200; Secure with response body ==>7B22726573706F6E736573223A5B7B226D6F64656C4E616D65223A22506572736F6E616C697A6174696F6E222C22746F70696373223A5B5D7D2C7B226D6F6465....... "POST /api/recommendations/b8aa5a1c-2f8d-db8d-1dfb-d6da8ce4f66f/batch HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive Content-Length: 258 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Content-Type: application/json sec-ch-ua-mobile: ?0 Accept: */* Origin: https://learn.microsoft.com X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D" with payload::==> "{"locale":"en-us","documentId":"c89966aa-b155-c98a-2391-47e01d468236","requests":[{"modelName":"TrainingRelated","take":1},{"modelName":"CertificationRelated","take":1},{"modelName":"Personalization","visitorId":"1f0d2d8726514c9d973d49400b3b6479","take":8}]}" HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://learn.microsoft.com Content-Encoding: gzip Vary: Origin Accept-Encoding Request-Context: appId=cid-v1:8da7faac-355b-4ce1-beec-f624ec5c6263 X-ms-Operation-Id: b8099460ff83cee97ff0b91b45fac6bb X-Content-Type-Options: nosniff x-azure-ref: 20260526T055746Z-175bc444c79q224vhC1STOakw40000000t70000000002k64 nel: {"report_to":"network-errors" "max_age":604800 "success_fraction":0.01 "failure_fraction":1.0} report-to: {"group":"network-errors" "max_age":604800 "endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]} Content-Length: 413 Cache-Control: public max-age=43200 Expires: Tue 26 May 2026 17:57:46 GMT Date: Tue 26 May 2026 05:57:46 GMT Connection: keep-alive Akamai-Cache-Status: Miss from child NotCacheable from parent Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Set-Cookie: bm_sv=8F581D2E30100645B93B7803DB9C9B7A~YAAQxgPXF/OVLUKeAQAAoVLcYh9B+TUsL+wAQotX2jdhyjpsZpxjjdQqCIteRMhSnHsE0jt19/T0e9dIoNptovx0uNSpqmP4iyoov9xs2HXtGdT1eR+/leLHx4LPO5B+URFVaFkGck4/05YyiC9An8T5O5T+UQ7KLkSJNCShrGT76iABRgiO6Spghzz8EpD8QzI24zACg34IlmBHYpan0zsVoGl0pJmpFrwct/L4C7V7DToV00+rC/n3tR1M3fbet+qE~1; Domain=.microsoft.com; Path=/; Expires=Tue 26 May 2026 07:57:46 GMT; Max-Age=7200; Secure with response body ==>7B22726573706F6E736573223A5B7B226D6F64656C4E616D65223A22506572736F6E616C697A6174696F6E222C22746F70696373223A5B5D7D2C7B226D6F6465....... "POST /akam/13/pixel_174b2aa4 HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive Content-Length: 3705 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 Accept: */* Origin: https://learn.microsoft.com X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF6mVLUKeAQAAfE7cYh/p8rSRQmfoD+nMarRTaxsM+z0xBTAGYjyXCmyWFgmjPqrKrEgwcAJc4PkYl08AV/0+qUIz4QpEbyCsxRQUPff9WBjc90o0ICoyTrQGEuI+OWYaNZWaV485wLkzscWYomZsw3V5GPdrHNCoD4qkvl8HDWGzXvLpFQcc73psBGhteEEGfsrlyrqzjU6DQN+sj/mGBJSlCxPB+NmaAHGdp2ofGxWlUZ+qYE/gc+bfb2mJqBdNiFuaPo1oiBJVpAl7VzR4cHR/MeZuZC9ylThVxKePsl9auYzsqk+rEI7luZ8h7YhQVm78wZZav7e8ps+s++qPwKkAXs9TFSf/G5XPMMQi3MbS6biXXK5c8L0ElcxBXLzJiYpjuy3bR30rm5SS9mTIOyVg4F2Jm8qDfYuu2w==; MicrosoftApplicationsTelemetryDeviceId=63c46548-3737-44bf-ab23-99ccefd44c35; ai_session=F7XXjzbaotMtPffipJl+Q6|1779775066180|1779775066180; bm_sv=A9DF8A43A13ECC0215762BC2632AF205~YAAQxgPXF8mVLUKeAQAAzlDcYh8zg7BF6Uy/zuvFdJwbOylUY5gtUZg9ALjNo3fmVHxelKblswjFknM4B/Eol/q8Jgc0fY3sv+N9U9TO3Qc6KvPnwhp4ChYHiOLQ7S3iZQ3D3++icJCQIWO5skH+So03UwnaQXfsoDM2UxXm6wkxtDKQy/U29n+WRx4AZCQQPwJR3jsnszsyi9/GCtibvrTpkHxi58RYaL9nbjjxxObwaKKw6sPodsMaeKcRO7O1PVM4~1" with payload::==> "ap=true&bt=%7B%22charging%22%3Atrue%2C%22chargingTime%22%3A0%2C%22dischargingTime%22%3A%22Infinity%22%2C%22level%22%3A1%2C%22onchargingchange%22%3Anull%2C%22onchargingtimechange%22%3Anull%2C%22ondischargingtimechange%22%3Anull%2C%22onlevelchange%22%3Anull%7D&fonts=null&fh=null&timing=%7B%221%22%3A215%2C%222%22%3A316%2C%223%22%3A418%2C%224%22%3A525%2C%225%22%3A626%2C%226%22%3A726%2C%22profile%22%3A%7B%22bp%22%3A1%2C%22sr%22%3A0%2C%22dp%22%3A0%2C%22lt%22%3A0%2C%22ps%22%3A0%2C%22cv%22%3A207%2C%22fp%22%3A0%2C%22sp%22%3A0%2C%22br%22%3A0%2C%22ieps%22%3A1%2C%22av%22%3A0%2C%22z1%22%3A3%2C%22jsv%22%3A1%2C%22nav%22%3A0%2C%22nap%22%3A1%2C%22crc%22%3A1%2C%22z2%22%3A0%2C%22z3%22%3A0%2C%22z4%22%3A1%2C%22z5%22%3A1%2C%22z6%22%3A0%7D%2C%22main%22%3A8306%2C%22compute%22%3A215%2C%22send%22%3A727%7D&bp=2087755996%2C1953464915%2C591862434%2C325835597%2C1068473606%2C-1382186647%2C-365096851%2C-1979186206%2C-108039040%2C-1906852049&sr=%7B%22inner%22%3A%5B1272%2C676%5D%2C%22outer%22%3A%5B1280%2C760%5D%2C%22screen%22%3A%5B0%2C0%5D%2C%22pageOffset%22%3A%5B0%2C0%5D%2C%22avail%22%3A%5B1280%2C760%5D%2C%22size%22%3A%5B1280%2C800%5D%2C%22client%22%3A%5B1262%2C3942%5D%2C%22colorDepth%22%3A32%2C%22pixelDepth%22%3A32%7D&dp=%7B%22XDomainRequest%22%3A0%2C%22createPopup%22%3A0%2C%22removeEventListener%22%3A1%2C%22globalStorage%22%3A0%2C%22openDatabase%22%3A0%2C%22indexedDB%22%3A1%2C%22attachEvent%22%3A0%2C%22ActiveXObject%22%3A0%2C%22dispatchEvent%22%3A1%2C%22addBehavior%22%3A0%2C%22addEventListener%22%3A1%2C%22detachEvent%22%3A0%2C%22fireEvent%22%3A0%2C%22MutationObserver%22%3A1%2C%22HTMLMenuItemElement%22%3A0%2C%22Int8Array%22%3A1%2C%22postMessage%22%3A1%2C%22querySelector%22%3A1%2C%22getElementsByClassName%22%3A1%2C%22images%22%3A1%2C%22compatMode%22%3A%22CSS1Compat%22%2C%22documentMode%22%3A0%2C%22all%22%3A1%2C%22now%22%3A1%2C%22contextMenu%22%3A0%7D<=1779775065918-7&ps=true%2Ctrue&cv=dbc159daa05441a953e50638f96e8dd2b4f6343d&fp=false&sp=false&br=Chrome&ieps=false&av=false&z=%7B%22a%22%3A390801874%2C%22b%22%3A1%2C%22c%22%3A1%7D&zh=&jsv=1.5&nav=%7B%22userAgent%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F145.0.0.0%20Safari%2F537.36%20Edg%2F145.0.0.0%22%2C%22appName%22%3A%22Netscape%22%2C%22appCodeName%22%3A%22Mozilla%22%2C%22appVersion%22%3A%225.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F145.0.0.0%20Safari%2F537.36%20Edg%2F145.0.0.0%22%2C%22appMinorVersion%22%3A0%2C%22product%22%3A%22Gecko%22%2C%22productSub%22%3A%2220030107%22%2C%22vendor%22%3A%22Google%20Inc.%22%2C%22vendorSub%22%3A%22%22%2C%22buildID%22%3A0%2C%22platform%22%3A%22Win32%22%2C%22oscpu%22%3A0%2C%22hardwareConcurrency%22%3A2%2C%22language%22%3A%22en-US%22%2C%22languages%22%3A%5B%22en-US%22%2C%22en%22%5D%2C%22systemLanguage%22%3A0%2C%22userLanguage%22%3A0%2C%22doNotTrack%22%3Anull%2C%22msDoNotTrack%22%3A0%2C%22cookieEnabled%22%3Atrue%2C%22geolocation%22%3A1%2C%22vibrate%22%3A1%2C%22maxTouchPoints%22%3A0%2C%22webdriver%22%3Afalse%2C%22plugins%22%3A%5B%22PDF%20Viewer%22%2C%22Chrome%20PDF%20Viewer%22%2C%22Chromium%20PDF%20Viewer%22%2C%22Microsoft%20Edge%20PDF%20Viewer%22%2C%22WebKit%20built-in%20PDF%22%5D%7D&crc=%7B%22window.chrome%22%3A%7B%22app%22%3A%7B%22isInstalled%22%3Afalse%2C%22InstallState%22%3A%7B%22DISABLED%22%3A%22disabled%22%2C%22INSTALLED%22%3A%22installed%22%2C%22NOT_INSTALLED%22%3A%22not_installed%22%7D%2C%22RunningState%22%3A%7B%22CANNOT_RUN%22%3A%22cannot_run%22%2C%22READY_TO_RUN%22%3A%22ready_to_run%22%2C%22RUNNING%22%3A%22running%22%7D%7D%7D%7D&t=f3bb101487442793dd27afe050e968ba7a60d348&u=0eba2b4a8762543da54d4a15a3545ffc&nap=11311144241322244122" HTTP/1.1 200 OK Content-Type: text/html Content-Length: 0 Cache-Control: max-age=0 Expires: Tue 26 May 2026 05:57:47 GMT Date: Tue 26 May 2026 05:57:47 GMT Connection: keep-alive Akamai-Cache-Status: NotCacheable from child report-to: {"group":"network-errors" "max_age":604800 "endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]} nel: {"report_to":"network-errors" "max_age":604800 "success_fraction":0.01 "failure_fraction":1.0} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Set-Cookie: ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF1GWLUKeAQAAMFfcYh8GRc84bhgUkqo86TYvfe/udy1aaSkg1X6+imYwnBCWFkti2J32+sZvEJvgx6QdejTHkazVdCeucMvenJN5XzHSkCoTbmPBxAO18R34WdcXWf6qKH+ln4nw5CIsGlEdwCwt/MBLAlnHCp4OV7YJYCtz0ohExiaYKEi1rIoi9dIVyN4ZYfkhqU0NAfYnirA6iCQNC8RHJkAptdbQPI2ohYiGLLYUIq5BywZNlBDwhRstfb9LcERsm0qVDiwmnngZmjbT117CV4FlnJnVoz5ZkE43OxkePRWe34WQd5EZh2uRhMjJX/ntiHGjCR2VSYjwevUe27aCNtQpnJuyVRk2rOZugh5E0jJSdBf0dnin0ccsAZX+JcoVMqm6ILL2MYyWh5w4qr6rBFuksd0INKavu68qViRobTbJhcWBWQRI+/WjeqLC6FFX; Domain=.microsoft.com; Path=/; Expires=Tue 26 May 2026 07:57:33 GMT; Max-Age=7186; HttpOnly with no response body "POST /akam/13/pixel_174b2aa4 HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive Content-Length: 3579 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 Accept: */* Origin: https://learn.microsoft.com X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; MicrosoftApplicationsTelemetryDeviceId=63c46548-3737-44bf-ab23-99ccefd44c35; bm_sv=53BF3E21F9804611047A0769F5256F91~YAAQxgPXF2mWLUKeAQAA41fcYh97lg/8Y/lsfQDIvnlDU3saJrtBRMmCL0kDKeLv2/RZUFs8I3CD0It+iNDEw7M2mzogywAdvc+HE+PgCcFdswl/0+H4J608J5n9Rj2getRzAbqsDDhsnvN27u6JCPe1gHc8Jk+gLkSsxzVuceG5+m5EE+7D6NI1CnbpwkZEGsJMWt/GHRswNkcZKf5OR0TIdKGOgXkiNvCv1y6+mV0QAYi+7a5LTu+vXoE7LcGPxPvm~1; ai_session=F7XXjzbaotMtPffipJl+Q6|1779775066180|1779775068844; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF5qWLUKeAQAA1FrcYh8MyL9x2dy40rmWa3jX79nRF3avmaAxywbV1E6n9kWa9DIjqGQOazKA458LPutzKpfLHvL+ue2ijLWjJWy4fsCXUXuhDg44Nu+xCm1eLkGsEFEf8+haOBeP680J6ymuoaceEqe3+QbnxXI2x90Lf5+aGKaF8ugy5w2Ak5Wny3YFBgjck8T7UkPoBmXvsfiInblh9vyV2IT6RkgZzAtzhzRcXSzSPqBfm6xtDmLBaoo34uwXbQ14tLUfa0oF2UE1+8MR3w1P5AdbQiA11XAeMW7TbJj5VwBEw8EhF5mGBkjt4NEKwrzR1TdKbzzzO9+pnOL1dpx7SATm5FKgyr+KdJgUtX7aaEdHU+L8z62mpamBtC0QMyGR6m1MMnMllIU24OcegTe0lFw4I1/D0pm1a8gBiwRb55Cl++FBBeFD3Us=" with payload::==> "ap=true&bt=%7B%22charging%22%3Atrue%2C%22chargingTime%22%3A0%2C%22dischargingTime%22%3A%22Infinity%22%2C%22level%22%3A1%2C%22onchargingchange%22%3Anull%2C%22onchargingtimechange%22%3Anull%2C%22ondischargingtimechange%22%3Anull%2C%22onlevelchange%22%3Anull%7D&fonts=null&fh=null&timing=%7B%221%22%3A130%2C%222%22%3A1172%2C%22profile%22%3A%7B%22bp%22%3A2%2C%22sr%22%3A90%2C%22dp%22%3A1%2C%22lt%22%3A0%2C%22ps%22%3A0%2C%22cv%22%3A27%2C%22fp%22%3A1%2C%22sp%22%3A0%2C%22br%22%3A0%2C%22ieps%22%3A0%2C%22av%22%3A0%2C%22z1%22%3A6%2C%22jsv%22%3A1%2C%22nav%22%3A0%2C%22nap%22%3A1%2C%22crc%22%3A1%2C%22z2%22%3A1%7D%2C%22main%22%3A14197%2C%22compute%22%3A130%2C%22send%22%3A1172%7D&bp=2087755996%2C1953464915%2C591862434%2C325835597%2C1068473606%2C-1382186647%2C-365096851%2C-1979186206%2C-108039040%2C-1906852049&sr=%7B%22inner%22%3A%5B1272%2C676%5D%2C%22outer%22%3A%5B0%2C0%5D%2C%22screen%22%3A%5B0%2C0%5D%2C%22pageOffset%22%3A%5B0%2C0%5D%2C%22avail%22%3A%5B1280%2C760%5D%2C%22size%22%3A%5B1280%2C800%5D%2C%22client%22%3A%5B1262%2C3942%5D%2C%22colorDepth%22%3A32%2C%22pixelDepth%22%3A32%7D&dp=%7B%22XDomainRequest%22%3A0%2C%22createPopup%22%3A0%2C%22removeEventListener%22%3A1%2C%22globalStorage%22%3A0%2C%22openDatabase%22%3A0%2C%22indexedDB%22%3A1%2C%22attachEvent%22%3A0%2C%22ActiveXObject%22%3A0%2C%22dispatchEvent%22%3A1%2C%22addBehavior%22%3A0%2C%22addEventListener%22%3A1%2C%22detachEvent%22%3A0%2C%22fireEvent%22%3A0%2C%22MutationObserver%22%3A1%2C%22HTMLMenuItemElement%22%3A0%2C%22Int8Array%22%3A1%2C%22postMessage%22%3A1%2C%22querySelector%22%3A1%2C%22getElementsByClassName%22%3A1%2C%22images%22%3A1%2C%22compatMode%22%3A%22CSS1Compat%22%2C%22documentMode%22%3A0%2C%22all%22%3A1%2C%22now%22%3A1%2C%22contextMenu%22%3A0%7D<=1779775068720-7&ps=true%2Ctrue&cv=dbc159daa05441a953e50638f96e8dd2b4f6343d&fp=false&sp=false&br=Chrome&ieps=false&av=false&z=%7B%22a%22%3A390801874%2C%22b%22%3A1%2C%22c%22%3A1%7D&zh=&jsv=1.5&nav=%7B%22userAgent%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F145.0.0.0%20Safari%2F537.36%20Edg%2F145.0.0.0%22%2C%22appName%22%3A%22Netscape%22%2C%22appCodeName%22%3A%22Mozilla%22%2C%22appVersion%22%3A%225.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F145.0.0.0%20Safari%2F537.36%20Edg%2F145.0.0.0%22%2C%22appMinorVersion%22%3A0%2C%22product%22%3A%22Gecko%22%2C%22productSub%22%3A%2220030107%22%2C%22vendor%22%3A%22Google%20Inc.%22%2C%22vendorSub%22%3A%22%22%2C%22buildID%22%3A0%2C%22platform%22%3A%22Win32%22%2C%22oscpu%22%3A0%2C%22hardwareConcurrency%22%3A2%2C%22language%22%3A%22en-US%22%2C%22languages%22%3A%5B%22en-US%22%2C%22en%22%5D%2C%22systemLanguage%22%3A0%2C%22userLanguage%22%3A0%2C%22doNotTrack%22%3Anull%2C%22msDoNotTrack%22%3A0%2C%22cookieEnabled%22%3Atrue%2C%22geolocation%22%3A1%2C%22vibrate%22%3A1%2C%22maxTouchPoints%22%3A0%2C%22webdriver%22%3Afalse%2C%22plugins%22%3A%5B%22PDF%20Viewer%22%2C%22Chrome%20PDF%20Viewer%22%2C%22Chromium%20PDF%20Viewer%22%2C%22Microsoft%20Edge%20PDF%20Viewer%22%2C%22WebKit%20built-in%20PDF%22%5D%7D&crc=%7B%22window.chrome%22%3A%7B%22app%22%3A%7B%22isInstalled%22%3Afalse%2C%22InstallState%22%3A%7B%22DISABLED%22%3A%22disabled%22%2C%22INSTALLED%22%3A%22installed%22%2C%22NOT_INSTALLED%22%3A%22not_installed%22%7D%2C%22RunningState%22%3A%7B%22CANNOT_RUN%22%3A%22cannot_run%22%2C%22READY_TO_RUN%22%3A%22ready_to_run%22%2C%22RUNNING%22%3A%22running%22%7D%7D%7D%7D&t=f3bb101487442793dd27afe050e968ba7a60d348&u=0eba2b4a8762543da54d4a15a3545ffc&nap=11311144241322244122" HTTP/1.1 200 OK Content-Type: text/html Content-Length: 0 Cache-Control: max-age=0 Expires: Tue 26 May 2026 05:57:50 GMT Date: Tue 26 May 2026 05:57:50 GMT Connection: keep-alive Akamai-Cache-Status: NotCacheable from child report-to: {"group":"network-errors" "max_age":604800 "endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]} nel: {"report_to":"network-errors" "max_age":604800 "success_fraction":0.01 "failure_fraction":1.0} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Set-Cookie: ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXFwiXLUKeAQAA7V/cYh/YuftDcH4b//jtq43BzU751pRfD8Jj5WF0mrQ+KykjX2Nk7IjwMzhzT6KHcgjoVVPsz6be1XDeNEl7NqHC4yoKav/YbiXXQ+rVN2ZhF8z7PvPnYHQWocP+zxYAVxvPZQCBY2ujCyNfUkpef3ZdVd1xjrY8wH2xNRkLkQFh7ApkIvVF+FWR+fh8vdcw/dxM5P150TrahMaRZejNhfSBox5eqDKrUQKCsAdhSao3h1+qZHirj0vat/ky9Xzmn69zxbADSDSklRivBm5Eur5Q1qzvxJgyKzZzs03K5dS9H3hUUHsUHZ4rD1AfVJyYSov5hcO8pMU1L/qWPK4WF5pSpnARWpPMhUfsv8lAk5q5vZSTOMcCaSaQD3k4KmUzyUHkeWEugbyDF/oKAlxCXbY+Ym3lCl3BPsZeI4SwEiDN7pZnBN7H+hes; Domain=.microsoft.com; Path=/; Expires=Tue 26 May 2026 07:57:33 GMT; Max-Age=7183; HttpOnly with no response body "POST /chromewebstore/v1.1/items/verify HTTP/2 Host: www.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Content-Type: application/json Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "{"hash":"QK/Paqqx9obHCVMc2wDzv7x8yej1Yd6CXtltuCTEnQ0=","ids":["ghbmnnjooekpmoecnnnilnnbdlolhkhi"],"protocol_version":1}" HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Tue 26 May 2026 05:57:45 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff Vary: Referer Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT.......40:T6c4,Found reference to "AesFastEngine" (Indicator: "Aes"; Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp") Found reference to "AesGcm256" (Indicator: "Aes"; Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp")41:T4e2,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001220.00000000.100210.03240000.00000004.mdmp 00000000-00001220.00000001.102131.03240000.00000004.mdmp 00000000-00001220.00000002.104052.03240000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001220.00000000.100210.03240000.00000004.mdmp 00000000-00001220.00000001.102131.03240000.00000004.mdmp 00000000-00001220.00000002.104052.03240000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001220.00000001.102131.00419000.00000004.mdmp 00000000-00001220.00000002.104052.05382000.00000020.mdmp "Software\Valve\SteamLogin Data" in Source: 00000000-00001220.00000001.102131.00419000.00000004.mdmp 00000000-00001220.00000002.104052.05382000.00000020.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001220.00000001.102131.03240000.00000004.mdmp 00000000-00001220.00000002.104052.03240000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001220.00000001.102131.03240000.00000004.mdmp 00000000-00001220.00000002.104052.03240000.00000004.mdmp42:T245f,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001220.00000000.100210.03240000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0(]w%" - Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hd=xz" - Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp") Found URL "http://www.microsoft.com0+4t8qrjqz20190328134534.282z0washington1redmond1microsoft" - Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf" - Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0//go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applauncmsedgehtm145574-clsid\" - Source: "00000000-00001220.00000001.102131.03240000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0009&osver=6&isserver=0&shimver=4.0.30319.0http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0openrunasttp://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0ttp://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0openashttp://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0968c7dc0b4726acb9ead06092a059fbf34d1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0145574-clsid\" - Source: "00000000-00001220.00000001.102131.03240000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0145574-clsid\" - Source: "00000000-00001220.00000001.102131.03240000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001220.00000001.102131.03240000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0//go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applauncmsedgehtm145574-clsid\" - Source: "00000000-00001220.00000002.104052.03240000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0009&osver=6&isserver=0&shimver=4.0.30319.0http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0openrunasttp://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0ttp://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0openashttp://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0968c7dc0b4726acb9ead06092a059fbf34d1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0145574-clsid\" - Source: "00000000-00001220.00000002.104052.03240000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=applaunch2&plcid=0x409&o1=shim_noversion_found&version=(null)&processname=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isserver=0&shimver=4.0.30319.0145574-clsid\" - Source: "00000000-00001220.00000002.104052.03240000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001220.00000002.104052.03240000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0(]w%" - Source: "00000000-00001220.00000002.104052.05382000.00000020.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hd=xz" - Source: "00000000-00001220.00000002.104052.05382000.00000020.mdmp") Found URL "http://www.microsoft.com0+4t8qrjqz20190328134534.282z0washington1redmond1microsoft" - Source: "00000000-00001220.00000002.104052.05382000.00000020.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0tf" - Source: "00000000-00001220.00000002.104052.05382000.00000020.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001220.00000002.104052.05382000.00000020.mdmp")43:Tbe1,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001220.00000000.100210.03240000.00000004.mdmp, 00000000-00001220.00000001.102131.03240000.00000004.mdmp, 00000000-00001220.00000002.104052.03240000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001220.00000000.100210.03240000.00000004.mdmp, 00000000-00001220.00000001.102131.03240000.00000004.mdmp, 00000000-00001220.00000002.104052.03240000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001220.00000000.100210.03240000.00000004.mdmp, 00000000-00001220.00000001.102131.03240000.00000004.mdmp, 00000000-00001220.00000002.104052.03240000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001220.00000000.100210.03240000.00000004.mdmp, 00000000-00001220.00000001.102131.03240000.00000004.mdmp, 00000000-00001220.00000002.104052.03240000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001220.00000000.100210.03240000.00000004.mdmp, 00000000-00001220.00000001.102131.03240000.00000004.mdmp, 00000000-00001220.00000002.104052.03240000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001220.00000000.100210.03240000.00000004.mdmp, 00000000-00001220.00000001.102131.03240000.00000004.mdmp, 00000000-00001220.00000002.104052.03240000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001220.00000000.100210.03240000.00000004.mdmp, 00000000-00001220.00000001.102131.03240000.00000004.mdmp, 00000000-00001220.00000002.104052.03240000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001220.00000000.100210.03240000.00000004.mdmp, 00000000-00001220.00000001.102131.03240000.00000004.mdmp, 00000000-00001220.00000002.104052.03240000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp")44:T420,Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001220.00000001.102131.00414000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001220.00000001.102131.00414000.00000002.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp")45:T4b8,Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 54.69.132.250 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 142.250.189.195 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 63.140.39.244 on port 443 (TCP); Domain: "microsoftmscompoc.tt.omtrdc.net" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 20.110.205.119 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.10 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.11 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 23.33.40.144 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 23.33.40.146 on port 443 (UDP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 23.51.57.215 on port 80 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 54.188.158.97 on port 443 (TCP); Domain: "mscom.demdex.net"46:T444,GET /dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "5.0.0" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=176995354795947:T44a,GET /en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "5.0.0" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=176995354795948:T5b5,GET /static/assets/0.4.03427.7856-752ce836/styles/site.css HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: text/css,*/*;q=0.1 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==49:T5af,GET /_themes/docs.theme/master/en-us/_themes/global/deprecation.js HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==4a:T5b3,GET /static/assets/0.4.03427.7856-752ce836/scripts/en-us/index-docs.js HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==4b:T607,GET /en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==4c:T60f,GET /en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started-details.png HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==4d:T60e,GET /en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==4e:T60b,GET /en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==4f:T608,GET /en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==50:T582,GET /akam/13/174b2aa4 HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==51:T604,POST /api/recommendations/b8aa5a1c-2f8d-db8d-1dfb-d6da8ce4f66f/batch HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive Content-Length: 258 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Content-Type: application/json sec-ch-ua-mobile: ?0 Accept: */* Origin: https://learn.microsoft.com X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==52:T5d8,GET /static/assets/0.4.03427.7856-752ce836/styles/docons.752ce83.7a2010b1.woff2 HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive Origin: https://learn.microsoft.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://learn.microsoft.com/static/assets/0.4.03427.7856-752ce836/styles/site.css Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D53:T59d,GET /en-us/content-nav/site-header/site-header.json? HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==54:T62c,GET /en-us/content-nav/MSDocsHeader-DotNet.json? HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D55:T61b,GET /en-us/feature-rollout.json HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D56:T620,GET /en-us/dotnet/framework/toc.json HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D57:T621,GET /en-us/dotnet/breadcrumb/toc.json HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; ak_bmsc=43DEEBF886BEF52EBAAAECA44B42BF8C~000000000000000000000000000000~YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D58:T63d,GET /en-us/banners/index.json HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF6mVLUKeAQAAfE7cYh/p8rSRQmfoD+nMarRTaxsM+z0xBTAGYjyXCmyWFgmjPqrKrEgwcAJc4PkYl08AV/0+qUIz4QpEbyCsxRQUPff9WBjc90o0ICoyTrQGEuI+OWYaNZWaV485wLkzscWYomZsw3V5GPdrHNCoD4qkvl8HDWGzXvLpFQcc73psBGhteEEGfsrlyrqzjU6DQN+sj/mGBJSlCxPB+NmaAHGdp2ofGxWlUZ+qYE/gc+bfb2mJqBdNiFuaPo1oiBJVpAl7VzR4cHR/MeZuZC9ylThVxKePsl9auYzsqk+rEI7luZ8h7YhQVm78wZZav7e8ps+s++qPwKkAXs9TFSf/G5XPMMQi3MbS6biXXK5c8L0ElcxBXLzJiYpjuy3bR30rm5SS9mTIOyVg4F2Jm8qDfYuu2w==59:T860,POST /akam/13/pixel_174b2aa4 HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive Content-Length: 3705 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 Accept: */* Origin: https://learn.microsoft.com X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF6mVLUKeAQAAfE7cYh/p8rSRQmfoD+nMarRTaxsM+z0xBTAGYjyXCmyWFgmjPqrKrEgwcAJc4PkYl08AV/0+qUIz4QpEbyCsxRQUPff9WBjc90o0ICoyTrQGEuI+OWYaNZWaV485wLkzscWYomZsw3V5GPdrHNCoD4qkvl8HDWGzXvLpFQcc73psBGhteEEGfsrlyrqzjU6DQN+sj/mGBJSlCxPB+NmaAHGdp2ofGxWlUZ+qYE/gc+bfb2mJqBdNiFuaPo1oiBJVpAl7VzR4cHR/MeZuZC9ylThVxKePsl9auYzsqk+rEI7luZ8h7YhQVm78wZZav7e8ps+s++qPwKkAXs9TFSf/G5XPMMQi3MbS6biXXK5c8L0ElcxBXLzJiYpjuy3bR30rm5SS9mTIOyVg4F2Jm8qDfYuu2w==; MicrosoftApplicationsTelemetryDeviceId=63c46548-3737-44bf-ab23-99ccefd44c35; ai_session=F7XXjzbaotMtPffipJl+Q6|1779775066180|1779775066180; bm_sv=A9DF8A43A13ECC0215762BC2632AF205~YAAQxgPXF8mVLUKeAQAAzlDcYh8zg7BF6Uy/zuvFdJwbOylUY5gtUZg9ALjNo3fmVHxelKblswjFknM4B/Eol/q8Jgc0fY3sv+N9U9TO3Qc6KvPnwhp4ChYHiOLQ7S3iZQ3D3++icJCQIWO5skH+So03UwnaQXfsoDM2UxXm6wkxtDKQy/U29n+WRx4AZCQQPwJR3jsnszsyi9/GCtibvrTpkHxi58RYaL9nbjjxxObwaKKw6sPodsMaeKcRO7O1PVM4~15a:T808,GET /api/taxonomies?name=devlang&locale=en-us HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF6mVLUKeAQAAfE7cYh/p8rSRQmfoD+nMarRTaxsM+z0xBTAGYjyXCmyWFgmjPqrKrEgwcAJc4PkYl08AV/0+qUIz4QpEbyCsxRQUPff9WBjc90o0ICoyTrQGEuI+OWYaNZWaV485wLkzscWYomZsw3V5GPdrHNCoD4qkvl8HDWGzXvLpFQcc73psBGhteEEGfsrlyrqzjU6DQN+sj/mGBJSlCxPB+NmaAHGdp2ofGxWlUZ+qYE/gc+bfb2mJqBdNiFuaPo1oiBJVpAl7VzR4cHR/MeZuZC9ylThVxKePsl9auYzsqk+rEI7luZ8h7YhQVm78wZZav7e8ps+s++qPwKkAXs9TFSf/G5XPMMQi3MbS6biXXK5c8L0ElcxBXLzJiYpjuy3bR30rm5SS9mTIOyVg4F2Jm8qDfYuu2w==; MicrosoftApplicationsTelemetryDeviceId=63c46548-3737-44bf-ab23-99ccefd44c35; ai_session=F7XXjzbaotMtPffipJl+Q6|1779775066180|1779775066180; bm_sv=53BF3E21F9804611047A0769F5256F91~YAAQxgPXF9yVLUKeAQAAO1HcYh+H+4FrjWBzeMjYZ0Mon3JlJ1ksdq86HszqZ8blWcWyOzooDBr+d1F9SBK+gjWasNKKkDg/2+sHVvaNowaNfzwQHHVb2FZtLLdRA8QZb558t8TxBGXEHkt0LZMnw83eHczuV/IPZy3fIspqk2KP95MVevXdWGZrZLJS4U5toVFYk05bYUHZZJ5937NOC651e8OY4yZgx6zGSLMaGEgJLbo3MhBICzAgJnZ/36sycgcs~15b:T838,GET /media/logos/logo_net.svg HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF6mVLUKeAQAAfE7cYh/p8rSRQmfoD+nMarRTaxsM+z0xBTAGYjyXCmyWFgmjPqrKrEgwcAJc4PkYl08AV/0+qUIz4QpEbyCsxRQUPff9WBjc90o0ICoyTrQGEuI+OWYaNZWaV485wLkzscWYomZsw3V5GPdrHNCoD4qkvl8HDWGzXvLpFQcc73psBGhteEEGfsrlyrqzjU6DQN+sj/mGBJSlCxPB+NmaAHGdp2ofGxWlUZ+qYE/gc+bfb2mJqBdNiFuaPo1oiBJVpAl7VzR4cHR/MeZuZC9ylThVxKePsl9auYzsqk+rEI7luZ8h7YhQVm78wZZav7e8ps+s++qPwKkAXs9TFSf/G5XPMMQi3MbS6biXXK5c8L0ElcxBXLzJiYpjuy3bR30rm5SS9mTIOyVg4F2Jm8qDfYuu2w==; MicrosoftApplicationsTelemetryDeviceId=63c46548-3737-44bf-ab23-99ccefd44c35; ai_session=F7XXjzbaotMtPffipJl+Q6|1779775066180|1779775066180; bm_sv=53BF3E21F9804611047A0769F5256F91~YAAQxgPXF9yVLUKeAQAAO1HcYh+H+4FrjWBzeMjYZ0Mon3JlJ1ksdq86HszqZ8blWcWyOzooDBr+d1F9SBK+gjWasNKKkDg/2+sHVvaNowaNfzwQHHVb2FZtLLdRA8QZb558t8TxBGXEHkt0LZMnw83eHczuV/IPZy3fIspqk2KP95MVevXdWGZrZLJS4U5toVFYk05bYUHZZJ5937NOC651e8OY4yZgx6zGSLMaGEgJLbo3MhBICzAgJnZ/36sycgcs~15c:T7d5,GET /en-us/media/event-banners/banner-build-2026.png HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/static/assets/0.4.03427.7856-752ce836/styles/site.css Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; MicrosoftApplicationsTelemetryDeviceId=63c46548-3737-44bf-ab23-99ccefd44c35; ai_session=F7XXjzbaotMtPffipJl+Q6|1779775066180|1779775066180; bm_sv=8F581D2E30100645B93B7803DB9C9B7A~YAAQxgPXF/OVLUKeAQAAoVLcYh9B+TUsL+wAQotX2jdhyjpsZpxjjdQqCIteRMhSnHsE0jt19/T0e9dIoNptovx0uNSpqmP4iyoov9xs2HXtGdT1eR+/leLHx4LPO5B+URFVaFkGck4/05YyiC9An8T5O5T+UQ7KLkSJNCShrGT76iABRgiO6Spghzz8EpD8QzI24zACg34IlmBHYpan0zsVoGl0pJmpFrwct/L4C7V7DToV00+rC/n3tR1M3fbet+qE~1; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF1GWLUKeAQAAMFfcYh8GRc84bhgUkqo86TYvfe/udy1aaSkg1X6+imYwnBCWFkti2J32+sZvEJvgx6QdejTHkazVdCeucMvenJN5XzHSkCoTbmPBxAO18R34WdcXWf6qKH+ln4nw5CIsGlEdwCwt/MBLAlnHCp4OV7YJYCtz0ohExiaYKEi1rIoi9dIVyN4ZYfkhqU0NAfYnirA6iCQNC8RHJkAptdbQPI2ohYiGLLYUIq5BywZNlBDwhRstfb9LcERsm0qVDiwmnngZmjbT117CV4FlnJnVoz5ZkE43OxkePRWe34WQd5EZh2uRhMjJX/ntiHGjCR2VSYjwevUe27aCNtQpnJuyVRk2rOZugh5E0jJSdBf0dnin0ccsAZX+JcoVMqm6ILL2MYyWh5w4qr6rBFuksd0INKavu68qViRobTbJhcWBWQRI+/WjeqLC6FFX5d:T84a,GET /static/third-party/MathJax/3.2.2/tex-mml-chtml.js HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive Origin: https://learn.microsoft.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; MicrosoftApplicationsTelemetryDeviceId=63c46548-3737-44bf-ab23-99ccefd44c35; ai_session=F7XXjzbaotMtPffipJl+Q6|1779775066180|1779775066180; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF2iWLUKeAQAA41fcYh++5Maz6EdOF38Od+ySLdpU96rQa/cqgPIg+FReReQwxxQ8AVAdwyjLYAvDJy20nRqNvzspfUBzQpTXGZQHOcUDls2QrciyStwGS4XMYoGbjmbxOvoytVWs3gimmHwYwaGWtdngcqx4tjYx3y9zTtlMb2JR/ihxsHRHK3TWqbX+M2DBNUlXg46MmRhYrhxpv9Z8u3hHBJSSrg4LqQn79zC5atTgRoS5103Jkydq1eQcku31UpmgvvuvF4QRuOLTfn/RXc9804eZt9xQDDmxNqyTrcMGSKuq7FvOT56ApJpX6MdO2ARpOKHiJnM+DLbd9e5+xAiwnagWHHtaF2xXb+lF7Ac8rA3CfTxXo3nwlhJH9Zc9vxabG1FnKmiLgAGxJxH9ZFXLpr9jtUlUVmv3Cx0T9l8B7R54FTllDIm/ckw=; bm_sv=53BF3E21F9804611047A0769F5256F91~YAAQxgPXF2mWLUKeAQAA41fcYh97lg/8Y/lsfQDIvnlDU3saJrtBRMmCL0kDKeLv2/RZUFs8I3CD0It+iNDEw7M2mzogywAdvc+HE+PgCcFdswl/0+H4J608J5n9Rj2getRzAbqsDDhsnvN27u6JCPe1gHc8Jk+gLkSsxzVuceG5+m5EE+7D6NI1CnbpwkZEGsJMWt/GHRswNkcZKf5OR0TIdKGOgXkiNvCv1y6+mV0QAYi+7a5LTu+vXoE7LcGPxPvm~15e:T861,GET /en-us/media/ask-learn/meet-ask-learn-base.png HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; MicrosoftApplicationsTelemetryDeviceId=63c46548-3737-44bf-ab23-99ccefd44c35; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF2iWLUKeAQAA41fcYh++5Maz6EdOF38Od+ySLdpU96rQa/cqgPIg+FReReQwxxQ8AVAdwyjLYAvDJy20nRqNvzspfUBzQpTXGZQHOcUDls2QrciyStwGS4XMYoGbjmbxOvoytVWs3gimmHwYwaGWtdngcqx4tjYx3y9zTtlMb2JR/ihxsHRHK3TWqbX+M2DBNUlXg46MmRhYrhxpv9Z8u3hHBJSSrg4LqQn79zC5atTgRoS5103Jkydq1eQcku31UpmgvvuvF4QRuOLTfn/RXc9804eZt9xQDDmxNqyTrcMGSKuq7FvOT56ApJpX6MdO2ARpOKHiJnM+DLbd9e5+xAiwnagWHHtaF2xXb+lF7Ac8rA3CfTxXo3nwlhJH9Zc9vxabG1FnKmiLgAGxJxH9ZFXLpr9jtUlUVmv3Cx0T9l8B7R54FTllDIm/ckw=; bm_sv=53BF3E21F9804611047A0769F5256F91~YAAQxgPXF2mWLUKeAQAA41fcYh97lg/8Y/lsfQDIvnlDU3saJrtBRMmCL0kDKeLv2/RZUFs8I3CD0It+iNDEw7M2mzogywAdvc+HE+PgCcFdswl/0+H4J608J5n9Rj2getRzAbqsDDhsnvN27u6JCPe1gHc8Jk+gLkSsxzVuceG5+m5EE+7D6NI1CnbpwkZEGsJMWt/GHRswNkcZKf5OR0TIdKGOgXkiNvCv1y6+mV0QAYi+7a5LTu+vXoE7LcGPxPvm~1; ai_session=F7XXjzbaotMtPffipJl+Q6|1779775066180|17797750688445f:T852,GET /en-us/media/logos/logo_net.svg HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; MicrosoftApplicationsTelemetryDeviceId=63c46548-3737-44bf-ab23-99ccefd44c35; bm_sv=53BF3E21F9804611047A0769F5256F91~YAAQxgPXF2mWLUKeAQAA41fcYh97lg/8Y/lsfQDIvnlDU3saJrtBRMmCL0kDKeLv2/RZUFs8I3CD0It+iNDEw7M2mzogywAdvc+HE+PgCcFdswl/0+H4J608J5n9Rj2getRzAbqsDDhsnvN27u6JCPe1gHc8Jk+gLkSsxzVuceG5+m5EE+7D6NI1CnbpwkZEGsJMWt/GHRswNkcZKf5OR0TIdKGOgXkiNvCv1y6+mV0QAYi+7a5LTu+vXoE7LcGPxPvm~1; ai_session=F7XXjzbaotMtPffipJl+Q6|1779775066180|1779775068844; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF5qWLUKeAQAA1FrcYh8MyL9x2dy40rmWa3jX79nRF3avmaAxywbV1E6n9kWa9DIjqGQOazKA458LPutzKpfLHvL+ue2ijLWjJWy4fsCXUXuhDg44Nu+xCm1eLkGsEFEf8+haOBeP680J6ymuoaceEqe3+QbnxXI2x90Lf5+aGKaF8ugy5w2Ak5Wny3YFBgjck8T7UkPoBmXvsfiInblh9vyV2IT6RkgZzAtzhzRcXSzSPqBfm6xtDmLBaoo34uwXbQ14tLUfa0oF2UE1+8MR3w1P5AdbQiA11XAeMW7TbJj5VwBEw8EhF5mGBkjt4NEKwrzR1TdKbzzzO9+pnOL1dpx7SATm5FKgyr+KdJgUtX7aaEdHU+L8z62mpamBtC0QMyGR6m1MMnMllIU24OcegTe0lFw4I1/D0pm1a8gBiwRb55Cl++FBBeFD3Us=60:T865,GET /en-us/media/ask-learn/check-for-accuracy-base.png HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; MicrosoftApplicationsTelemetryDeviceId=63c46548-3737-44bf-ab23-99ccefd44c35; bm_sv=53BF3E21F9804611047A0769F5256F91~YAAQxgPXF2mWLUKeAQAA41fcYh97lg/8Y/lsfQDIvnlDU3saJrtBRMmCL0kDKeLv2/RZUFs8I3CD0It+iNDEw7M2mzogywAdvc+HE+PgCcFdswl/0+H4J608J5n9Rj2getRzAbqsDDhsnvN27u6JCPe1gHc8Jk+gLkSsxzVuceG5+m5EE+7D6NI1CnbpwkZEGsJMWt/GHRswNkcZKf5OR0TIdKGOgXkiNvCv1y6+mV0QAYi+7a5LTu+vXoE7LcGPxPvm~1; ai_session=F7XXjzbaotMtPffipJl+Q6|1779775066180|1779775068844; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF5qWLUKeAQAA1FrcYh8MyL9x2dy40rmWa3jX79nRF3avmaAxywbV1E6n9kWa9DIjqGQOazKA458LPutzKpfLHvL+ue2ijLWjJWy4fsCXUXuhDg44Nu+xCm1eLkGsEFEf8+haOBeP680J6ymuoaceEqe3+QbnxXI2x90Lf5+aGKaF8ugy5w2Ak5Wny3YFBgjck8T7UkPoBmXvsfiInblh9vyV2IT6RkgZzAtzhzRcXSzSPqBfm6xtDmLBaoo34uwXbQ14tLUfa0oF2UE1+8MR3w1P5AdbQiA11XAeMW7TbJj5VwBEw8EhF5mGBkjt4NEKwrzR1TdKbzzzO9+pnOL1dpx7SATm5FKgyr+KdJgUtX7aaEdHU+L8z62mpamBtC0QMyGR6m1MMnMllIU24OcegTe0lFw4I1/D0pm1a8gBiwRb55Cl++FBBeFD3Us=61:T83f,GET /favicon.ico HTTP/1.1 Host: learn.microsoft.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 X-Edge-Shopping-Flag: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: _uetvid=4fc4ece0ff7411f0aa9cd9a4b2358cdb; _clck=1jik8pc%5E2%5Eg37%5E1%5E2223; MC1=GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959; msal.cache.encryption=%7B%22id%22%3A%22019e62dc-4d76-70b7-8e82-7c5af709e5e5%22%2C%22key%22%3A%22BS_ygxfhgQSGaiVNWINrQwF6z6_1QZX0M6Sm0-aYV38%22%7D; MicrosoftApplicationsTelemetryDeviceId=63c46548-3737-44bf-ab23-99ccefd44c35; bm_sv=53BF3E21F9804611047A0769F5256F91~YAAQxgPXF2mWLUKeAQAA41fcYh97lg/8Y/lsfQDIvnlDU3saJrtBRMmCL0kDKeLv2/RZUFs8I3CD0It+iNDEw7M2mzogywAdvc+HE+PgCcFdswl/0+H4J608J5n9Rj2getRzAbqsDDhsnvN27u6JCPe1gHc8Jk+gLkSsxzVuceG5+m5EE+7D6NI1CnbpwkZEGsJMWt/GHRswNkcZKf5OR0TIdKGOgXkiNvCv1y6+mV0QAYi+7a5LTu+vXoE7LcGPxPvm~1; ai_session=F7XXjzbaotMtPffipJl+Q6|1779775066180|1779775068844; ak_bmsc=FC9436F70CC980349743BB6D965F7235~000000000000000000000000000000~YAAQxgPXF5qWLUKeAQAA1FrcYh8MyL9x2dy40rmWa3jX79nRF3avmaAxywbV1E6n9kWa9DIjqGQOazKA458LPutzKpfLHvL+ue2ijLWjJWy4fsCXUXuhDg44Nu+xCm1eLkGsEFEf8+haOBeP680J6ymuoaceEqe3+QbnxXI2x90Lf5+aGKaF8ugy5w2Ak5Wny3YFBgjck8T7UkPoBmXvsfiInblh9vyV2IT6RkgZzAtzhzRcXSzSPqBfm6xtDmLBaoo34uwXbQ14tLUfa0oF2UE1+8MR3w1P5AdbQiA11XAeMW7TbJj5VwBEw8EhF5mGBkjt4NEKwrzR1TdKbzzzO9+pnOL1dpx7SATm5FKgyr+KdJgUtX7aaEdHU+L8z62mpamBtC0QMyGR6m1MMnMllIU24OcegTe0lFw4I1/D0pm1a8gBiwRb55Cl++FBBeFD3Us=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790607605565,"unified_at":"2026-09-28T15:00:05.565Z","metadata":{"hashes":{"sha256":"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d","sha1":"8a40f85bf749113894042d1f9dd6459a210dc731","md5":"decb191783b6a1e222d1785f29f676ae","sha512":"676ef3f6bf50ad2524baea26a96fc2be1d81dae7ebc693137b3fef47407ede3db856123ada0350560184a71029473a34649664490cbf447b01867f5f21da9d7b","ssdeep":"49152:MD4cuCHVVezt0vpUNvHU0FOHx7kZO3o4R9IY:MD4cuCHVVezt0BUNv00F7EYLY","ssdeep_chunks":["49152:MD4cuCH","49152:D4cuCHV","49152:4cuCHVV","49152:cuCHVVe","49152:uCHVVez","49152:CHVVezt","49152:HVVezt0","49152:VVezt0v","49152:Vezt0vp","49152:ezt0vpU","49152:zt0vpUN","49152:t0vpUNv","49152:0vpUNvH","49152:vpUNvHU","49152:pUNvHU0","49152:UNvHU0F","49152:NvHU0FO","49152:vHU0FOH","49152:HU0FOHx","49152:U0FOHx7","49152:0FOHx7k","49152:FOHx7kZ","49152:OHx7kZO","49152:Hx7kZO3","49152:x7kZO3o","49152:7kZO3o4","49152:kZO3o4R","49152:ZO3o4R9","49152:O3o4R9I","49152:3o4R9IY","98304:MD4cuCH","98304:D4cuCHV","98304:4cuCHVV","98304:cuCHVVe","98304:uCHVVez","98304:CHVVezt","98304:HVVezt0","98304:VVezt0v","98304:Vezt0vp","98304:ezt0vpU","98304:zt0vpUN","98304:t0vpUNv","98304:0vpUNvH","98304:vpUNvHU","98304:pUNvHU0","98304:UNvHU0F","98304:NvHU0FO","98304:vHU0FOH","98304:HU0FOHx","98304:U0FOHx7","98304:0FOHx7k","98304:FOHx7kZ","98304:OHx7kZO","98304:Hx7kZO3","98304:x7kZO3o","98304:7kZO3o4","98304:kZO3o4R","98304:ZO3o4R9","98304:O3o4R9I","98304:3o4R9IY","49152:VVezt0B","49152:Vezt0BU","49152:ezt0BUN","49152:zt0BUNv","49152:t0BUNv0","49152:0BUNv00","49152:BUNv00F","49152:UNv00F7","49152:Nv00F7E","49152:v00F7EY","49152:00F7EYL","49152:0F7EYLY"],"imphash":"6adabf5929912c81c518ab88933ce307"},"file_info":{"file_name":"bounty-98991780990718275","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1731912,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1705304716000,"last_seen":1779774983000,"last_multi_scan":1779774983000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","redlinestealer","informationstealer","backdoor","redline"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":71},"sandbox_signatures":{"informative_count":153,"suspicious_count":18,"malicious_count":7,"total":178},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.PWSX-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Kryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.529497","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Deepscan-10028431-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.529497 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HVOP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!4C5DD33F93B020E0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005af2831 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-ADE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/SuspPack.AB.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusT.DUFR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.4476786","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Zusy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Creates new processes"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file packed with confuser protection"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"suspicious","value":"Contains ability to decrypt/decode data"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"suspicious","value":"Attempts to obtain browser cookies (file access)"},{"type":"suspicious","value":"Able to retrieves browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"},{"type":"informative","value":"Able to access Steam setting"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"References URL in command line"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"PCAP contains base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends a suspicious GET request"},{"type":"suspicious","value":"Attempts to call internet-related API for network communication"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"tactic":"Command and Control","technique":"Non-Standard Encoding","attack_id":"T1132.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/002","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"PCAP contains base64 strings","description":"Contains base64 encoded string \"YAAQxgPXFyKSLUKeAQAAoR7cYh8NYLCjs+AREK0WjzhUn04RL0f9AvZ0G1WBXSLM/YsqXdfsHXI3WA8OB+vXpJCd3oydvNA4k4CiEpI2fbLrlEUdhbhQ85ZLc0eNFzKHXKkwirvS4d1wbwyDBTIcMkgXhBSuDu0yAwfRMovQI/DeAlOomqNEl9ptJfmSHbUWI5aYXFFEWemZjuZnVWmpsOSfFqsHS98JMIn24yY/Ei24DOpJ0CcTQ2DjoeHlkrDwD41ul0Ct74wN6ODLwrh3a06q5zoj3R+qGcKWW+tg6vz+cr/NUwlZJeKitgAo1ExANPdjvK6uUuODAyF161PRs/6SSIx04oaiD5rQTUfAPUNtzBMGxrQRQJBskqKjOPVtvFHDifhT2A==\" in [Source : PCAP]\n Contains base64 encoded string \"YAAQxgPXF6mVLUKeAQAAfE7cYh/p8rSRQmfoD+nMarRTaxsM+z0xBTAGYjyXCmyWFgmjPqrKrEgwcAJc4PkYl08AV/0+qUIz4QpEbyCsxRQUPff9WBjc90o0ICoyTrQGEuI+OWYaNZWaV485wLkzscWYomZsw3V5GPdrHNCoD4qkvl8HDWGzXvLpFQcc73psBGhteEEGfsrlyrqzjU6DQN+sj/mGBJSlCxPB+NmaAHGdp2ofGxWlUZ+qYE/gc+bfb2mJqBdNiFuaPo1oiBJVpAl7VzR4cHR/MeZuZC9ylThVxKePsl9auYzsqk+rEI7luZ8h7YhQVm78wZZav7e8ps+s++qPwKkAXs9TFSf/G5XPMMQi3MbS6biXXK5c8L0ElcxBXLzJiYpjuy3bR30rm5SS9mTIOyVg4F2Jm8qDfYuu2w==\" in [Source : PCAP]","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-504","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$26","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 28079-148-0040B258","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 28079-84-004094E0\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 28079-84-004094E0\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 28079-148-0040B258","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.6358","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: PCAP contains base64 strings\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: PCAP contains base64 strings\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$27","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStrings\" in file \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\"\n Found system information discovery API: \"GetUserObjectInformationA\" in file \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"file/memory contains long string with (Indicator: \"postmessage\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004304)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004304)\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004304)\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004304)\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"GetUserNameExW\" with parameters (UID: 00000000-00004304)\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"GetUserNameExA\" with parameters (UID: 00000000-00004304)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004304)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004304)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004304)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$29","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\")\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"USESHORTNAME\")\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\\SUPPORTEDPROTOCOLS\")\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"APPENDPATH\")\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.\" - (UID: 00000000-00004304)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"learn.microsoft.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"150.171.109.197:443\"\n \"142.251.142.234:443\"\n \"150.171.109.198:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4304:168:WilStaging_02\"\n Process 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:4304:64:WilError_01\"\n Process 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe created mutex with name \"Local\\SM0:4304:64:WilError_01\"\n Process 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe created mutex with name \"Local\\SM0:4304:168:WilStaging_02\"\n Process 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe created mutex with name \"SM0:4304:64:WilError_01\"\n Process 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4304:64:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\\\mscoreeis.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 771A0000\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72A80000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74650000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\" has an executable section named \".text\"\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\" has an executable section named \".bss\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\" file has an entrypoint instructions - \"call\t0x40927c,jmp\t0x4053be,cmp\tecx, dword ptr [0x5a553c],jne\t0x405524,repz ret\t,jmp\t0x409312,push\teax,push\tdword ptr fs:[0],lea\teax, [esp + 0xc],sub\tesp, dword ptr [esp + 0xc],push\tebx,push\tesi,push\tedi,mov\tdword ptr [eax], ebp,mov\tebp, eax,mov\teax, dword ptr [0x5a553c],xor\teax, ebp,push\teax,push\tdword ptr [ebp - 4],mov\tdword ptr [ebp - 4], 0xffffffff,lea\teax, [ebp - 0xc],mov\tdword ptr fs:[0], eax,ret\t,push\teax,push\tdword ptr fs:[0],lea\teax, [esp + 0xc],sub\tesp, dword ptr [esp + 0xc],push\tebx,push\tesi,push\tedi,mov\tdword ptr [eax], ebp,mov\tebp, eax,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".data\" is \"0x18d600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x18e0b8\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$2f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"edge-consumer-static.azureedge.net\"\n \"edgeassetservice.azureedge.net\"\n \"js.monitor.azure.com\"\n \"www.googleapis.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00004304-00000C2D-1947362263]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\\\mscoreeis.dll\" [Source: 00000000-00004304-00000C2A-2348312139]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreeis.dll\" [Source: 00000000-00004304-00000C2A-2348362843]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$30","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$31","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$32","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_2b82e96\" has type \"HTML document ASCII text with very long lines (427)\"- [targetUID: 00000000-00004304]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" queries basic process information of the \"C:\\2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (UID: 4304)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" trying to access non-existent file \"C:\\2B82E968C7DC0B4726ACB9EAD06092A059FBF34E9068532AD1151C479E5B331D.EXE.LOCAL\"\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\MSCOREE.DLL.LOCAL\"\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\mscoree.dll.local\"\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" trying to access non-existent file \"C:\\2B82E968C7DC0B4726ACB9EAD06092A059FBF34E9068532AD1151C479E5B331D.EXE.CONFIG\"\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" trying to access non-existent file \"C:\\2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"$37","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"www.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$38","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$39","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"6{s\\;owNf~N}w]y;[}]\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"learn.microsoft.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$3a","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Network Related","name":"Sends a suspicious GET request","description":"$3b","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-19","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"www.googleapis.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"150.171.109.197\" on port \"443\"\n HTTPS traffic to \"142.251.142.234\" on port \"443\"\n HTTPS traffic to \"150.171.109.198\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 713E0000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n file/memory contains long string with (Indicator: \".encrypt\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetEnvironmentStrings\" (Indicator: \"GetEnvironmentStrings\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyA\" in file \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\PROGRAM FILES (X86)\\MICROSOFT\\EDGE\\APPLICATION\\MSEDGE.EXE\"; Value: \"FCB4228CD4ECDC010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\PROGRAM FILES (X86)\\MICROSOFT\\EDGE\\APPLICATION\\MSEDGE.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\" was detected as \"Visual C++ 2008 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" at 00000000-00004304-00000C15-2355102260","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\" has section name .data with entropy \"7.611444730270234\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"18/26 Antivirus vendors marked sample as malicious (69% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$3f","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid code section of PE file \"sample.bin\"\n YARA signature for invalid Timestamp of PE file \"sample.bin\"\n YARA signature for invalid Base of code of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser cookies (file access)","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" attempting to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" attempting to open a file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"","origin":"API Call","mitre_attack_id":"T1539","relevance":10,"id":"api-301","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 28079-1-00405510","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\" claimed CRC 1767702 while the actual is CRC 1746477","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n TerminateProcess\n GetProcAddress\n UnhandledExceptionFilter\n GetModuleHandleA\n GetStartupInfoA\n IsDebuggerPresent\n GetModuleHandleW\n Sleep\n WriteFile\n VirtualAlloc\n GetTickCount\n CreateThread\n GetCommandLineA\n LoadLibraryA\n GetModuleFileNameA\n VirtualProtect","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.\" - (UID: 00000000-00004304)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"18/26 Antivirus vendors marked sample as malicious (69% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"ShellExecuteW\" with parameter http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2 (UID: 00000000-00004304)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to access Steam setting","description":"Found string \"Software\\Valve\\SteamLogin Data\" (Indicator: \"software\\valve\\steam\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518","relevance":1,"id":"string-763","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001220.00000001.102131.00414000.00000002.mdmp, 00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00001220.00000001.102131.00414000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00001220.00000001.102131.00414000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$40","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file packed with confuser protection","description":"Observed string: \"ConfusedByAttribute\" (Indicator: \"ConfusedByAttribute\") in Source: 00000000-00001220.00000001.102131.00419000.00000004.mdmp\n 00000000-00001220.00000002.104052.05382000.00000020.mdmp\n Observed string: \"Confuser.Core 1.6.0+447341964f\" (Indicator: \"Confuser.Core \") in Source: 00000000-00001220.00000001.102131.00419000.00000004.mdmp\n 00000000-00001220.00000002.104052.05382000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1027.002","relevance":1,"id":"string-232","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001220.00000001.102131.00414000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00001220.00000001.102131.00414000.00000002.mdmp\")\n Found reference to API \"tQuerySystemInformation\" (Indicator: \"QuerySystemInformation\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"QuerySystemInformation\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")\n Found reference to API \"GetMonitorInfo\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001220.00000001.102131.00414000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM\" (Source: 00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp, Indicator: \"select * from\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileMapping\" (Indicator: \"CreateFile\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")\n Found reference to API \"21588542838,5672,3185,,ShellExecuteW,Shell32.dll,\"00:26:10.062\",RX=0,PX=0\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001220.00000001.102131.03240000.00000004.mdmp, 00000000-00001220.00000002.104052.03240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$41","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"msedge.exe\" is creating a new process (Name: \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"33.1.2.0\"\n \"15.9.1.22\"\n \"0.0.0.0\"\n \"1.1.1.1\"\n \"16.0.0.0\"\n \"11.0.0.0\"\n \"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$42","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Pattern Matching","name":"Windows security alert lure","description":"Discovered multiple strings which indicate a Microsoft Windows security alert lure. (Source: screen_7.png | String(s): \"microsoft\"\n \"support\"\n \"virus\")","origin":"File/Memory","relevance":10,"id":"string-703","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00001220\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEDF092C7F5959E37623EF273F2145]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001220.00000001.102131.03240000.00000004.mdmp, 00000000-00001220.00000002.104052.03240000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEAA462B6E58508BFC8A0B03A8A3C7]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001220.00000001.102131.03240000.00000004.mdmp, 00000000-00001220.00000002.104052.03240000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001220.00000001.102131.03240000.00000004.mdmp, 00000000-00001220.00000002.104052.03240000.00000004.mdmp\")\n Found string \"F+ncalrpc:[OLEDF092C7F5959E37623EF273F2145]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001220.00000001.102131.03240000.00000004.mdmp, 00000000-00001220.00000002.104052.03240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")\n Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDevice\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"ZIndicates if the text in the edit control should appear as the default password character.\" (Indicator: \"password\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00001220.00000001.102131.00419000.00000004.mdmp\n 00000000-00001220.00000002.104052.05382000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001220-00000C2B-481582206\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001220.00000000.100210.03240000.00000004.mdmp, 00000000-00001220.00000001.102131.03240000.00000004.mdmp, 00000000-00001220.00000002.104052.03240000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume1\\??\\Volume{815ead30-0000-0000-0000-100000000000}\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001220.00000001.102131.03240000.00000004.mdmp, 00000000-00001220.00000002.104052.03240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; File: \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d\")\n Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001220.00000001.102131.00414000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Able to retrieves browser cookies data","description":"Found string \"cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")\n Found string \"//settString.Replaceing[@name=\\UString.Replacesername\\]/vaString.ReplacelueLocal Extension Settingsmoz_cookies\" (Indicator: \"moz_cookies\"; Source: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"suspicious","category":"General","name":"References URL in command line","description":"Process \"msedge.exe\" with commandline \"--single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0\" (UID: 00000000-00001988)\n Process \"msedge.exe\" with commandline \"--single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0\" (UID: 00000000-00001272)","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":1,"id":"target-174","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"NtConnectPort\" with parameters (UID: 00000000-00001220)\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00001220)\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"NtAlpcSendWaitReceivePort\" with parameters (UID: 00000000-00001220)\n \"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe\" called \"NtAlpcConnectPortEx\" with parameters (UID: 00000000-00001220)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"$45","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected text artifact in screenshot that indicate file could be ransomware","description":"\"virustotal\" (Source: screen_7.png, Indicator: \"virus\")","origin":"File/Memory","relevance":10,"id":"string-12","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"ttps://api.ip.sb/ip\" (Indicator: \"api.ip.sb\"; File: \"00000000-00001220.00000001.102131.00419000.00000004.mdmp, 00000000-00001220.00000002.104052.05382000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - RedLine","description":"YARA signature Malware.RedLine matched on process \"00000000-00001220\"","origin":"YARA Signature","relevance":10,"id":"yara-9","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]}]},"activity":{"stats":{"process_count":28,"spawned_processes_count":28,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":186,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":6,"contacted_urls_count":32,"http_requests_count":32},"behavior_tags":["commodity","redlinestealer","informationstealer","backdoor","redline"],"sample_flags":["Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"6a1536068372bccd4d0acc58","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","contacted_countries":["USA"],"submit_name":"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d","analysis_start_time":"2026-05-26T05:56:54+00:00","indicators_count":{"informative":113,"suspicious":22,"malicious":5},"tags":["Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true},{"id":"683ef27716a9a8c62b062a6b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d","analysis_start_time":"2025-06-03T13:02:48+00:00","indicators_count":{"informative":128,"suspicious":25,"malicious":5},"tags":["Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"150.171.109.197","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"address":"142.251.142.234","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"address":"150.171.109.198","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"address":"54.69.132.250","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"address":"54.188.158.97","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]}],"dns_resolutions":[{"domain":"edge-consumer-static.azureedge.net","address":"150.171.109.198","ttl":267,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"domain":"edgeassetservice.azureedge.net","address":"150.171.109.197","ttl":211,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"domain":"js.monitor.azure.com","address":"150.171.109.196","ttl":217,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"domain":"www.googleapis.com","address":"142.251.142.234","ttl":3724,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"domain":"microsoftmscompoc.tt.omtrdc.net","address":"63.140.39.244","ttl":13,"country":"United States","registrar_name":"NOM-IQ Ltd dba Com Laude","registrar_organization":"Adobe Systems Incorporated","registrar_name_servers":"ns2.omtrdc.net","registrar_creation_date":"2008-07-23T17:14:42+00:00","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"domain":"mscom.demdex.net","address":"54.188.158.97","ttl":261,"country":"United States","registrar_name":"NOM-IQ Ltd dba Com Laude","registrar_organization":"Adobe Systems Incorporated","registrar_name_servers":"udns2.ultradns.net","registrar_creation_date":"2008-08-12T01:04:44+00:00","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]}],"http_requests":[{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0","method":"GET","response_code":"302","response_phrase":"Moved Temporarily","header":"$46","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0","method":"GET","response_code":"200","response_phrase":"OK","header":"$47","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/static/assets/0.4.03427.7856-752ce836/styles/site.css","method":"GET","response_code":"200","response_phrase":"OK","header":"$48","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/_themes/docs.theme/master/en-us/_themes/global/deprecation.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$49","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/static/assets/0.4.03427.7856-752ce836/scripts/en-us/index-docs.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$4a","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png","method":"GET","response_code":"200","response_phrase":"OK","header":"$4b","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started-details.png","method":"GET","response_code":"200","response_phrase":"OK","header":"$4c","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png","method":"GET","response_code":"200","response_phrase":"OK","header":"$4d","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png","method":"GET","response_code":"200","response_phrase":"OK","header":"$4e","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png","method":"GET","response_code":"200","response_phrase":"OK","header":"$4f","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/akam/13/174b2aa4","method":"GET","response_code":"200","response_phrase":"OK","header":"$50","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/api/recommendations/b8aa5a1c-2f8d-db8d-1dfb-d6da8ce4f66f/batch","method":"POST","response_code":"200","response_phrase":"OK","header":"$51","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/static/assets/0.4.03427.7856-752ce836/styles/docons.752ce83.7a2010b1.woff2","method":"GET","response_code":"200","response_phrase":"OK","header":"$52","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/en-us/content-nav/site-header/site-header.json?","method":"GET","response_code":"200","response_phrase":"OK","header":"$53","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/en-us/content-nav/MSDocsHeader-DotNet.json?","method":"GET","response_code":"200","response_phrase":"OK","header":"$54","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/en-us/feature-rollout.json","method":"GET","response_code":"200","response_phrase":"OK","header":"$55","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/en-us/dotnet/framework/toc.json","method":"GET","response_code":"200","response_phrase":"OK","header":"$56","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/en-us/dotnet/breadcrumb/toc.json","method":"GET","response_code":"200","response_phrase":"OK","header":"$57","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/en-us/banners/index.json","method":"GET","response_code":"200","response_phrase":"OK","header":"$58","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/akam/13/pixel_174b2aa4","method":"POST","response_code":"200","response_phrase":"OK","header":"$59","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/api/taxonomies?name=devlang&locale=en-us","method":"GET","response_code":"200","response_phrase":"OK","header":"$5a","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/media/logos/logo_net.svg","method":"GET","response_code":"302","response_phrase":"Moved Temporarily","header":"$5b","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/en-us/media/event-banners/banner-build-2026.png","method":"GET","response_code":"200","response_phrase":"OK","header":"$5c","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/static/third-party/MathJax/3.2.2/tex-mml-chtml.js","method":"GET","response_code":"200","response_phrase":"OK","header":"$5d","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/en-us/media/ask-learn/meet-ask-learn-base.png","method":"GET","response_code":"200","response_phrase":"OK","header":"$5e","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/en-us/media/logos/logo_net.svg","method":"GET","response_code":"200","response_phrase":"OK","header":"$5f","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/en-us/media/ask-learn/check-for-accuracy-base.png","method":"GET","response_code":"200","response_phrase":"OK","header":"$60","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"learn.microsoft.com","host_ip":"2.23.90.85:443","url":"/favicon.ico","method":"GET","response_code":"200","response_phrase":"OK","header":"$61","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"js.monitor.azure.com","host_ip":"150.171.109.196:443","url":"/scripts/c/ms.jsll-4.min.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /scripts/c/ms.jsll-4.min.js HTTP/2\nHost: js.monitor.azure.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://learn.microsoft.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=1\nAccept: */*\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: script","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"edgeassetservice.azureedge.net","host_ip":"150.171.109.197:443","url":"/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2\nHost: edgeassetservice.azureedge.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nEdge-Asset-Group: ArbitrationService\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"www.googleapis.com","host_ip":"142.251.142.234:443","url":"/chromewebstore/v1.1/items/verify","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /chromewebstore/v1.1/items/verify HTTP/2\nHost: www.googleapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nContent-Type: application/json\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"host":"edge-consumer-static.azureedge.net","host_ip":"150.171.109.198:443","url":"/mouse-gesture/config.json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /mouse-gesture/config.json HTTP/2\nHost: edge-consumer-static.azureedge.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Fetch-Site: none\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}],"processes":[{"pid":1220,"ppid":0,"name":"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe","command_line":"","sha256":"2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d","normalized_path":"C:\\2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe","uid":"00000000-00001220","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":1988,"ppid":1220,"name":"msedge.exe","command_line":"--single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001220","uid":"00000000-00001988"},{"pid":6344,"ppid":1988,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0x154,0x7ffcfad8b208,0x7ffcfad8b218,0x7ffcfad8b228","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00006344"},{"pid":6952,"ppid":1988,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:2","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00006952"},{"pid":5608,"ppid":1988,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:3","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00005608"},{"pid":7848,"ppid":1988,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00007848"},{"pid":324,"ppid":1988,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1748979427776303 --launch-time-ticks=1582595129 --mojo-platform-channel-handle=2740 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00000324"},{"pid":7620,"ppid":1988,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1748979427776303 --launch-time-ticks=1582872970 --mojo-platform-channel-handle=2752 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00007620"},{"pid":7444,"ppid":1988,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3604 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00007444"},{"pid":4124,"ppid":1988,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --time-ticks-at-unix-epoch=-1748979427776303 --launch-time-ticks=1587618143 --mojo-platform-channel-handle=5172 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00004124"},{"pid":4348,"ppid":1988,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5364 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00004348"},{"pid":6928,"ppid":1988,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4180 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00006928"},{"pid":7604,"ppid":1988,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4176 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00007604"},{"pid":4688,"ppid":1988,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=5424 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00004688"},{"pid":6696,"ppid":1988,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5356 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00006696"},{"pid":3224,"ppid":1988,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4384 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00003224"},{"pid":5132,"ppid":1988,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00005132"},{"pid":7828,"ppid":1988,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4332 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00007828"},{"pid":6156,"ppid":1988,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5580 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00006156"},{"pid":6040,"ppid":1988,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --time-ticks-at-unix-epoch=-1748979427776303 --launch-time-ticks=1683368432 --mojo-platform-channel-handle=1068 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00006040"},{"pid":8088,"ppid":1988,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --time-ticks-at-unix-epoch=-1748979427776303 --launch-time-ticks=1684179164 --mojo-platform-channel-handle=1700 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00008088"},{"pid":7144,"ppid":1988,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --time-ticks-at-unix-epoch=-1748979427776303 --launch-time-ticks=1685350946 --mojo-platform-channel-handle=5992 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00007144"},{"pid":7388,"ppid":1988,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5652 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00007388"},{"pid":4592,"ppid":1988,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --time-ticks-at-unix-epoch=-1748979427776303 --launch-time-ticks=1686150051 --mojo-platform-channel-handle=6040 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00004592"},{"pid":1668,"ppid":1988,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=5628 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00001668"},{"pid":1280,"ppid":1988,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1988 --field-trial-handle=2008,i,13325054522004694103,9283442502172297192,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001988","uid":"00000000-00001280"},{"pid":1272,"ppid":1220,"name":"msedge.exe","command_line":"--single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001220","uid":"00000000-00001272"},{"pid":7896,"ppid":1272,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0xcc,0xd0,0xd4,0xa4,0x160,0x7ffcfad8b208,0x7ffcfad8b218,0x7ffcfad8b228","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001272","uid":"00000000-00007896"}],"all_imported_dlls":["mscoree.dll","dpapi.dll","actxprxy.dll","deviceaccess.dll","slc.dll","wkscli.dll","userenv.dll","dmcmnutils.dll","vcruntime140.dll","ffmpeg.dll","npmproxy.dll","msvcp_win.dll","ws2_32.dll","Windows.Networking.Connectivity.dll","wow64cpu.dll","winmmbase.dll","DWrite.dll","rsaenh.dll","Windows.Devices.Enumeration.dll","bcryptprimitives.dll","mscoreei.dll","mscoreeis.dll","dnsapi.dll","wtsapi32.dll","advapi32.dll","ucrtbase.dll","comdlg32.dll","oleacc.dll","Windows.Security.Authentication.Web.Core.dll","PCPKsp.dll","BitsProxy.dll","libGLESv2.dll","gdi32full.dll","oleaut32.dll","ntmarta.dll","wininet.dll","winmm.dll","nlaapi.dll","wwapi.dll","dusmapi.dll","bcrypt.dll","crypt32.dll","Windows.System.Profile.RetailInfo.dll","ncryptprov.dll","d3d10warp.dll","DataExchange.dll","user32.dll","cryptbase.dll","winsta.dll","linkinfo.dll","dbghelp.dll","msctf.dll","msvcp110_win.dll","gdi32.dll","dwmapi.dll","TextInputFramework.dll","sechost.dll","samcli.dll","nsi.dll","wscapi.dll","VxSSL32.dll","OneCoreUAPCommonProxyStub.dll","wintrust.dll","webauthn.dll","comctl32.dll","imm32.dll","msedge_elf.dll","twinapi.appcore.dll","libEGL.dll","onnxruntime.dll","shell32.dll","cryptsp.dll","gpapi.dll","wldp.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","sppc.dll","rasadhlp.dll","mf.dll","cfgmgr32.dll","uxtheme.dll","urlmon.dll","iertutil.dll","sxs.dll","slwga.dll","windows.storage.dll","ntdll.dll","msvcrt.dll","kernel.appcore.dll","Windows.Shell.ServiceHostBuilder.dll","sspicli.dll","CoreMessaging.dll","msedge.dll","dhcpcsvc6.dll","dxgi.dll","atlthunk.dll","ResourcePolicyClient.dll","kernel32.dll","imagehlp.dll","secur32.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","dhcpcsvc.dll","setupapi.dll","wlanapi.dll","telclient.dll","mlang.dll","msasn1.dll","fwbase.dll","mswsock.dll","wow64.dll","wow64win.dll","mdmregistration.dll","deviceassociation.dll","win32u.dll","combase.dll","powrprof.dll","mscms.dll","KernelBase.dll","ieframe.dll","Windows.UI.dll","winhttp.dll","oneauth.dll","Windows.UI.Immersive.dll","aepic.dll","ncrypt.dll","rpcrt4.dll","netapi32.dll","netutils.dll","d3d11.dll","Windows.Security.Authentication.OnlineId.dll","FirewallAPI.dll","microsoft_shell_integration.dll","RTWorkQ.dll","WinTypes.dll","devobj.dll","well_known_domains.dll","ntasn1.dll","vk_swiftshader.dll","fltLib.dll","propsys.dll","KBDUS.DLL","tbs.dll","apphelp.dll","shlwapi.dll","version.dll","dsreg.dll","rmclient.dll","netprofm.dll","edputil.dll","twinapi.dll","rometadata.dll","dcomp.dll","domain_actions.dll","d3dcompiler_47.dll","clbcatq.dll","cldapi.dll","SHCore.dll","directmanipulation.dll","wevtapi.dll","CoreUIComponents.dll","biwinrt.dll","oneds.dll","mfplat.dll","IPHLPAPI.DLL","profapi.dll","ole32.dll","mfsensorgroup.dll","DolbyDecMFT.dll","Windows.Web.dll","UIAutomationCore.dll","mfperfhelper.dll","WofUtil.dll","cryptnet.dll","MicrosoftAccountTokenProvider.dll","fwpolicyiomgr.dll","vulkan-1.dll","FWPUCLNT.DLL","onramp.dll","microsoft_apis.dll","srumapi.dll","msmpeg2vdec.dll","dxva2.dll","CompPkgSup.dll","OneCoreCommonProxyStub.dll","Windows.Media.dll","vaultcli.dll","msvproc.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_2b82e96","sha256":"97569b5d87bd4d52fa0d7b3a0fc74f91f9956e9eb5dc709852a2410d1be58b13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"},{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4304:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4304:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"name":"Local\\SM0:4304:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"name":"Local\\SM0:4304:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"name":"SM0:4304:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4304:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a1536068372bccd4d0acc58"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1220:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1220:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"name":"Local\\SM0:1220:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"name":"SM0:1220:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"name":"Local\\SM0:1220:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1220:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683ef27716a9a8c62b062a6b"}]}]}},"report_ids":{"sandbox_job_ids":["6a1536068372bccd4d0acc58","683ef27716a9a8c62b062a6b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Zusy.Generic Sample 2b82e968c7dc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2b82e968c7dc…. Malware family: Zusy.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d"}],["$","meta","4",{"property":"og:title","content":"Malicious Zusy.Generic Sample 2b82e968c7dc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2b82e968c7dc…. Malware family: Zusy.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Zusy.Generic Sample 2b82e968c7dc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2b82e968c7dc…. Malware family: Zusy.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L62","11",{}]]