26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T447,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 346f5ff1750f… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 346f5ff1750f…. Threat score 85/100. 0/26 AV engines flagged this file. 3 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/346f5ff1750f46f19d671e47f5a40439ed90a3a19a6d0ef6f5e18de8d02f1d78","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","346f5ff1750f46f19d671e47f5a40439ed90a3a19a6d0ef6f5e18de8d02f1d78"],"about":{"@type":"SoftwareApplication","name":"点击此处安装汉化语言包.exe","applicationCategory":["compressed","64bits","innosetup"],"identifier":"346f5ff1750f46f19d671e47f5a40439ed90a3a19a6d0ef6f5e18de8d02f1d78","additionalType":"Malicious sample"},"threatScore":85,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":3,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T43b,file/memory contains long string with (Indicator: "VirtualAlloc"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") file/memory contains long string with (Indicator: "VirtualAlloc"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "VirtualAllocEx"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "WriteProcessMemory"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "VirtualFree"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp")28:T77e,file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") file/memory contains long string with (Indicator: "GetTickCount64"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp")29:T508,Found reference to "newHMAC" (Indicator: "HMAC"; File: ".exe") Found reference to "forHKDF" (Indicator: "HKDF"; File: ".exe") file/memory contains long string with (Indicator: "SHA512"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") file/memory contains long string with (Indicator: "SHA384"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") file/memory contains long string with (Indicator: "HMAC"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") file/memory contains long string with (Indicator: "HMACSHA512"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") file/memory contains long string with (Indicator: "TripleDES"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") file/memory contains long string with (Indicator: "SHA384"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "SHA512"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "HKDF"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "HMAC"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp")2a:T909,"_.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\67D147D5DAB7F28D663CA5B7A9568F087427B9F7") "_.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55") "_.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55") "_.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A031C46782E6E6C662C2C87C76DA9AA62CCABD8E") "_.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A031C46782E6E6C662C2C87C76DA9AA62CCABD8E") "_.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A399046417B67E320D3EFA69D7DCE6B8BFE8A9F2") "_.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A399046417B67E320D3EFA69D7DCE6B8BFE8A9F2") "_.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6") "_.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6") "_.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12") "_.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12") "_.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0") "_.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0") "_.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135") "_.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135") "_.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "_.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")2b:T976,"readelf.exe" queried SystemProcessInformation at 00000000-00002960-00000C15-1336752584 [PID: 2960] "readelf.exe" queried SystemProcessInformation at 00000000-00002960-00000C15-1336763024 [PID: 2960] "readelf.exe" queried SystemProcessInformation at 00000000-00002960-00000C15-1337306659 [PID: 2960] "readelf.exe" queried SystemProcessInformation at 00000000-00002960-00000C15-1337315493 [PID: 2960] "readelf.exe" queried SystemProcessInformation at 00000000-00002960-00000C15-1337523751 [PID: 2960] "readelf.exe" queried SystemProcessInformation at 00000000-00002960-00000C15-1337532322 [PID: 2960] "readelf.exe" queried SystemProcessInformation at 00000000-00002960-00000C15-1343518301 [PID: 2960] "readelf.exe" queried SystemProcessInformation at 00000000-00002960-00000C15-1343529293 [PID: 2960] "readelf.exe" queried SystemProcessInformation at 00000000-00003320-00000C15-1344782635 [PID: 3320] "readelf.exe" queried SystemProcessInformation at 00000000-00003320-00000C15-1344794884 [PID: 3320] "readelf.exe" queried SystemProcessInformation at 00000000-00003320-00000C15-1345154186 [PID: 3320] "readelf.exe" queried SystemProcessInformation at 00000000-00003320-00000C15-1345166019 [PID: 3320] "readelf.exe" queried SystemProcessInformation at 00000000-00003320-00000C15-1345572783 [PID: 3320] "readelf.exe" queried SystemProcessInformation at 00000000-00003320-00000C15-1345582126 [PID: 3320] "readelf.exe" queried SystemProcessInformation at 00000000-00003320-00000C15-1370947446 [PID: 3320] "readelf.exe" queried SystemProcessInformation at 00000000-00003320-00000C15-1370969994 [PID: 3320] "readelf.exe" queried SystemProcessInformation at 00000000-00004776-00000C15-1350056187 [PID: 4776] "readelf.exe" queried SystemProcessInformation at 00000000-00004776-00000C15-1350066462 [PID: 4776] "readelf.exe" queried SystemProcessInformation at 00000000-00004776-00000C15-1350445886 [PID: 4776] "readelf.exe" queried SystemProcessInformation at 00000000-00004776-00000C15-1350456880 [PID: 4776] "readelf.exe" queried SystemProcessInformation at 00000000-00004776-00000C15-1350693907 [PID: 4776] "readelf.exe" queried SystemProcessInformation at 00000000-00004776-00000C15-1350704232 [PID: 4776] "readelf.exe" queried SystemProcessInformation at 00000000-00004776-00000C15-1364127251 [PID: 4776] "readelf.exe" queried SystemProcessInformation at 00000000-00004776-00000C15-1364136185 [PID: 4776]2c:T34da,Found api reference "%s %qlz4: invalid block checksumlz4: invalid frame checksumfse decompress returned: %wcorrupt input: weights zeroOTEL_SPAN_EVENT_COUNT_LIMITNAF digits must fit in int8%s: missing target file: %sinvalid data-offsets offsetgf256: invalid polynomial: file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextos: process already finishedGetFileInformationByHandleExGC mark assist wait for workcomparing uncomparable type region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignal" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found api reference "%dcorrupt input: weight too largecorrupt input: tableLog too big invalid tableLog %d (%d -> %d)xxhash: invalid hash state sizeOTEL_SPAN_ATTRIBUTE_COUNT_LIMITOTEL_LINK_ATTRIBUTE_COUNT_LIMITca-ES-valencia en-US-u-va-posixleveldb/storage: already lockedleveldb/table: writer is closedBUG: Node.GetHandle on zero refcorrupted input (position != 0)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicysync: Unlock of unlocked RWMutexsync: negative WaitGroup counterslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointergetWeakHandle on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found api reference "%dcorrupt input: weight too largecorrupt input: tableLog too big invalid tableLog %d (%d -> %d)xxhash: invalid hash state sizeOTEL_SPAN_ATTRIBUTE_COUNT_LIMITOTEL_LINK_ATTRIBUTE_COUNT_LIMITca-ES-valencia en-US-u-va-posixleveldb/storage: already lockedleveldb/table: writer is closedBUG: Node.GetHandle on zero refcorrupted input (position != 0)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicysync: Unlock of unlocked RWMutexsync: negative WaitGroup counterslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointergetWeakHandle on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found api reference "(default %q) (default %v)file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #MapVirtualKeyWVirtualAllocExComputerNameExuserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found api reference "(default %q) (default %v)file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #MapVirtualKeyWVirtualAllocExComputerNameExuserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found api reference ", locked to thread, synctest bubble runtime.semacreateruntime.semawakeupdbiSeenTrayTooltipdbiLastUpdateCheckdbiReplaceEmojiOlddbiIncludeMutedOlddbiDownloadPathOlddbiAutoDownloadOlddbiModerateModeOlddbiSessionSettingsdbiSuggestEmojiOlddbiCallSettingsOlddas length is zeroonlineUpdatePeriodofflineBlurTimeoutofflineIdleTimeoutonlineFocusTimeoutonlineCloudTimeoutnotifyDefaultDelayrevokePrivateInboxstickersFavedLimitCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia Time Zone 3Fiji Standard Time: day out of rangeTime.MarshalJSON: Time.MarshalText: unknown time zone reflect.Value.Uintunexpected newlineCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidGetSidSubAuthorityMakeSelfRelativeSDQueryServiceStatusCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExGetIpForwardEntry2GetIpForwardTable2NotifyRouteChange2ClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetComputerNameExWGetConsoleOutputCPGetCurrentThreadIdGetModuleFileNameWGetModuleHandleExWGetVolumePathNameWRemoveDllDirectorySetConsoleOutputCPTerminateJobObjectEnumProcessModulesGetModuleBaseNameWcontext.Background" (Indicator: "CertGetNameStringW"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found api reference ", locked to thread, synctest bubble runtime.semacreateruntime.semawakeupdbiSeenTrayTooltipdbiLastUpdateCheckdbiReplaceEmojiOlddbiIncludeMutedOlddbiDownloadPathOlddbiAutoDownloadOlddbiModerateModeOlddbiSessionSettingsdbiSuggestEmojiOlddbiCallSettingsOlddas length is zeroonlineUpdatePeriodofflineBlurTimeoutofflineIdleTimeoutonlineFocusTimeoutonlineCloudTimeoutnotifyDefaultDelayrevokePrivateInboxstickersFavedLimitCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia Time Zone 3Fiji Standard Time: day out of rangeTime.MarshalJSON: Time.MarshalText: unknown time zone reflect.Value.Uintunexpected newlineCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidGetSidSubAuthorityMakeSelfRelativeSDQueryServiceStatusCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExGetIpForwardEntry2GetIpForwardTable2NotifyRouteChange2ClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetComputerNameExWGetConsoleOutputCPGetCurrentThreadIdGetModuleFileNameWGetModuleHandleExWGetVolumePathNameWRemoveDllDirectorySetConsoleOutputCPTerminateJobObjectEnumProcessModulesGetModuleBaseNameWcontext.Background" (Indicator: "CryptUnprotectData"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found api reference ", locked to thread, synctest bubble runtime.semacreateruntime.semawakeupdbiSeenTrayTooltipdbiLastUpdateCheckdbiReplaceEmojiOlddbiIncludeMutedOlddbiDownloadPathOlddbiAutoDownloadOlddbiModerateModeOlddbiSessionSettingsdbiSuggestEmojiOlddbiCallSettingsOlddas length is zeroonlineUpdatePeriodofflineBlurTimeoutofflineIdleTimeoutonlineFocusTimeoutonlineCloudTimeoutnotifyDefaultDelayrevokePrivateInboxstickersFavedLimitCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia Time Zone 3Fiji Standard Time: day out of rangeTime.MarshalJSON: Time.MarshalText: unknown time zone reflect.Value.Uintunexpected newlineCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidGetSidSubAuthorityMakeSelfRelativeSDQueryServiceStatusCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExGetIpForwardEntry2GetIpForwardTable2NotifyRouteChange2ClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetComputerNameExWGetConsoleOutputCPGetCurrentThreadIdGetModuleFileNameWGetModuleHandleExWGetVolumePathNameWRemoveDllDirectorySetConsoleOutputCPTerminateJobObjectEnumProcessModulesGetModuleBaseNameWcontext.Background" (Indicator: "PFXImportCertStore"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found api reference "%v%s revert error %qnegative memdb refmay not contain %qleveldb: not foundbackup CURRENT: %vmissing chunk partillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectGetDiskFreeSpaceExW2006-01-02 15:04:05RtlCreateUserThreadGetFileAttributesExsync.Cond is copiedstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=runtime: heapInUse=runtime: totalFree=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found api reference "%vinvalid malloc sizeinvalid key or typednbits: %08x, fs:%dinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsEnumProcessModulesExGetModuleFileNameExWNjUsk$%QKHWbAJuzq0wtroot\SecurityCenter2floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found api reference "%vinvalid malloc sizeinvalid key or typednbits: %08x, fs:%dinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsEnumProcessModulesExGetModuleFileNameExWNjUsk$%QKHWbAJuzq0wtroot\SecurityCenter2floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found api reference "%dinvalid negative valueinvalid block index %dunrecognized level: %qinvalid chunk type %#xbad index block handlebaseline can't be <= 0device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2" (Indicator: "CertGetCertificateChain"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found api reference "%stransaction@discard @%d%w: got %x; expected %xinvalid scalar encodingleveldb/storage: closedleveldb/table: nil filefloating point exceptionconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00004776.00000000.150753.FBFD0000.00000004.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00004776.00000000.150753.FBFD0000.00000004.mdmp")2d:T1651a,Contains base64 string in header "http" in header "GET / HTTP/1.1Host: www.baidu.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET / HTTP/1.1Host: www.baidu.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET / HTTP/1.1Host: www.baidu.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET / HTTP/1.1Host: www.baidu.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "/sg/msn/1/cm" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "32DFF8A43A9F6A9B15B5EE573B1A6B37" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gdpr" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "microsoftSsp" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "true" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gdpr" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "linkedin" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "1391f723" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "91e0" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "4064" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8cb8" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "08df8de6ce67" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Priority" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "222166F75FD3671F181970045E3D66DC" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gdpr" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "253A" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "252F" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "2526code" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "253D222166F75FD3671F181970045E3D66DC" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "2526gdpr" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "253D" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "2jUF" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "CcSjN55W" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "QrP7" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "s/xJ" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Shopping" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Flag" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "/seg" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "2Fib" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "2Fsetuid" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "3Fentity" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "2jUF" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "tbMHdFBv" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "EtCswDZk" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Priority" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Shopping" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Flag" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "priority" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "edgeassetservice" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "0Sec" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "corsEdge" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "POST" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "0Content" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Type" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "json" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "edge" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "consumer" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "0Sec" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "nonePriority" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty"2e:T418,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - ChaCha20 encryption algorithm2f:T2edb,Found XOR loop in file "JhwRME7kax.dll" at offset 18876; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 29246; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 68156; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 82810; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 101652; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 110835; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 139664; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 180076; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 180822; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 213730; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 240830; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 258421; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 289049; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 415933; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 483516; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 484363; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 560241; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 614981; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 662312; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 671921; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 673975; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 723548; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 734794; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 750597; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 763089; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 784196; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 810430; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 874215; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 883624; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 903962; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 924783; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 935111; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 984768; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1233865; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1312083; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1362786; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1414318; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1418147; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1418725; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1423702; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1507974; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1518489; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1569169; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1589058; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1612382; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1641924; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1679986; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1756670; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1796747; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1847639; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1873926; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1920925; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1954897; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 1991179; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 2075119; code bytes = 30d0 Found XOR loop in file "JhwRME7kax.dll" at offset 372675; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 385608; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 439510; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 656768; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 685140; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 725864; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 773876; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 872904; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 1073312; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 1100608; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 1329428; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 1392427; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 1454666; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 1456947; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 1574291; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 1649344; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 1898692; code bytes = 33c1 Found XOR loop in file "JhwRME7kax.dll" at offset 26619; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 31572; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 41645; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 69941; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 188341; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 205769; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 234882; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 265161; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 278941; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 297730; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 324679; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 379581; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 410517; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 417821; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 485358; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 518385; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 526394; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 537113; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 541872; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 567012; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 664755; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 670743; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 672788; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 706131; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 748185; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 768243; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 929791; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 957511; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 984902; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1129766; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1164514; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1181731; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1184430; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1223491; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1230385; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1296442; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1299471; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1381492; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1433282; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1456753; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1491468; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1504837; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1512669; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1559312; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1559652; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1653063; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1676763; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1686154; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1689089; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1701283; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1777109; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1795988; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1825494; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1842400; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1843552; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 1962208; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 2033877; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 2130123; code bytes = 8030 Found XOR loop in file "JhwRME7kax.dll" at offset 2147739; code bytes = 8030 Found XOR loop in file "readelf.exe" at offset 973476; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 527060; code bytes = 30d0 Found XOR loop in file "msvcp140.dll" at offset 537082; code bytes = 30d0 Found XOR loop in file "msvcp140.dll" at offset 313675; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 547475; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 537233; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 538918; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 549214; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 62464; code bytes = 33c1 Found XOR loop in file "vcruntime140.dll" at offset 103944; code bytes = 33c1 Found XOR loop in file "vcruntime140.dll" at offset 73408; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 93995; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 102810; code bytes = 8030 Found XOR loop in file "vcruntime140.dll" at offset 108837; code bytes = 8030 Found XOR loop in file "api-ms-win-crt-private-l1-1-0.dll" at offset 59178; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 14628; code bytes = 33c1 Found XOR loop in file "vcruntime140_1.dll" at offset 34105; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 38478; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 42920; code bytes = 8030 Found XOR loop in file "vcruntime140_1.dll" at offset 48950; code bytes = 8030 Found XOR loop in file "api-ms-win-core-xstate-l2-1-0.dll" at offset 13856; code bytes = 8030 Found XOR loop in file "api-ms-win-core-console-l1-2-0.dll" at offset 8860; code bytes = 8030 Found XOR loop in file "api-ms-win-core-errorhandling-l1-1-0.dll" at offset 11518; code bytes = 803030:T194c,Found string "dep github.com/RedTeamPentesting/kbtls v0.1.2 h1:7FAjrOTEytfHiZQ1u9PyCppBYHXT+nxGAzJ3ytxC+C4=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/UserExistsError/conpty v0.1.4 h1:+3FhJhiqhyEJa+K5qaK3/w6w+sN3Nh9O9VbJyBS02to=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/axgle/mahonia v0.0.0-20180208002826-3358181d7394 h1:OYA+5W64v3OgClL+IrOD63t4i/RW7RqrAVl9LTZ9UqQ=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/bodgit/plumbing v1.3.0 h1:pf9Itz1JOQgn7vEOE7v7nlEfBykYqvUYioC61TwWCFU=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/bodgit/sevenzip v1.6.1 h1:kikg2pUMYC9ljU7W9SaqHXhym5HyKm8/M/jd31fYan4=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/bodgit/windows v1.0.1 h1:tF7K6KOluPYygXa3Z2594zxlkbKPAOvqr97etrGNIz4=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/chocolatkey/chacha8 v0.0.0-20200308092524-06a0ce7f6716 h1:NSjnwJb5rlX8weAJPotMIFtWSFt4Tjtkjt7nTBil1dA=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/clipperhouse/stringish v0.1.1 h1:+NSqMOr3GR6k1FdRhhnXrLfztGzuG+VuFDfatpWHKCs=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/clipperhouse/uax29/v2 v2.3.0 h1:SNdx9DVUqMoBuBoW3iLOj4FQv3dN5mDtuqwuhIGpJy4=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/coder/websocket v1.8.14 h1:9L0p0iKiNOibykf283eHkKUHHrpG7f65OE3BhhO7v9g=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/go-faster/errors v0.7.1 h1:MkJTnDoEdi9pDabt1dpWf7AA8/BaSYZqibYyhZ20AYg=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/go-faster/jx v1.2.0 h1:T2YHJPrFaYu21fJtUxC9GzmluKu8rVIFDwwGBKTDseI=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/go-faster/xor v1.0.0 h1:2o8vTOgErSGHP3/7XwA5ib1FTtUsNtwCoLLBjl31X38=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/gocarina/gocsv v0.0.0-20240520201108-78e41c74b4b1 h1:FWNFq4fM1wPfcK40yHE5UO3RUdSNPaBC+j3PokzA6OQ=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/gotd/ige v0.2.2 h1:XQ9dJZwBfDnOGSTxKXBGP4gMud3Qku2ekScRjDWWfEk=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "dep github.com/gotd/neo v0.1.5 h1:oj0iQfMbGClP8xI59x7fE/uHoTJD7NZH9oV1WNuPukQ=" (Indicator: "github.com"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp")31:Tec8,"readelf.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002960) "readelf.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002960) "readelf.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003320) "readelf.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003320) "readelf.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004776) "readelf.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004776)32:T59e,file/memory contains long string with (Indicator: "select * from "; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found string "SELECT * FROM %Q.%Q" (Indicator: "select * from "; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found string "SELECT * FROM "%w"."%w_rowid" WHERE rowid=?1" (Indicator: "select * from "; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found string "SELECT * FROM %Q.'%q_rowid'" (Indicator: "select * from "; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found string "SELECT * FROM '%q'" (Indicator: "select * from "; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found string "SELECT * FROM sqlite_schema" (Indicator: "select * from "; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found string "SELECT * FROM sqlite_schema WHERE rootpage=0 OR rootpage IS NULL" (Indicator: "select * from "; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found string "SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0)" (Indicator: "select * from "; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found string "SELECT * FROM %Q.sqlite_schema" (Indicator: "select * from "; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp")33:T2436,Observed string: "but it's notcorrupt input: last value not power of twoleveldb/storage: invalid file for argumentinterrupted system call should be restarted/memory/classes/metadata/mcache/inuse:bytesruntime.SetFinalizer: first argument is nilruntime.SetFinalizer: finalizer already setgcBgMarkWorker: unexpected gcMarkWorkerModenon in-use span found with specials bit setgrew heap, but no adequate free space foundroot level max pages doesn't fit in summarymeasures of the retained heap are not equalruntime.Pinner: argument is not a pointer: runtime: releaseSudog with non-nil gp.paramunknown runnable goroutine during bootstrapruntime: casfrom_Gscanstatus bad oldval gp=runtime:stoplockedm: lockedg (atomicstatus=methodValueCallFrameObjs is not in a modulereset of synctest timer from outside bubblesynctest timer accessed from outside bubbleResizePseudoConsole failed with status 0x%xInitializeProcThreadAttributeList not foundlnk.header: error reading magic string - %slnk.LinkInfo: read LocalBasePathOffset - %sexec: WaitDelay expired before I/O completemult64bitPow10: power of 10 is out of range/AppData/Local/DCBrowser/User Data/Default/bufio: tried to rewind past start of buffermultiple Read calls return no data or errortransform: inconsistent byte count returnedsevenzip: unsupported compression algorithmreflect: nil type passed to Type.Implementshttp2: client conn could not be establishednet/http: timeout awaiting response headershttp2: unexpected ALPN protocol %q; want %qTransport: unhandled response frame type %TError enabling Transport HTTP/2 support: %vx509: failed to parse dnsName constraint %qx509: invalid X25519 private key parametersskipping walk firefox path permission errortls: received unexpected key update messagetls: no supported elliptic curves for ECDHEtls: server did not select an ALPN protocoltls: server sent unrequested session tickettls: received malformed key_share extensiontls: invalid early data for QUIC connection[ERR] socks: Failed to get version byte: %v[WARN] yamux: failed to send ping reply: %v[ERR] yamux: Failed to read stream data: %vimpl: package name must not contain slasheschunked encoding contains too much non-datahash/adler32: invalid hash state identifierexplicit time type given to non-time membersql: connection returned that was never outlzma.unmarshalBinary: data has wrong lengthAccountClearRecentEmojiStatusesRequest(nil)AccountDeleteAutoSaveExceptionsRequest(nil)AccountGetBotBusinessConnectionRequest(nil)AccountGetDefaultBackgroundEmojisRequest%+vAccountGetDefaultGroupPhotoEmojisRequest%+vAccountGetGlobalPrivacySettingsRequest(nil)AccountGetReactionsNotifySettingsRequest%+vAccountSaveAutoDownloadSettingsRequest(nil)AccountSetGlobalPrivacySettingsRequest(nil)AccountSetReactionsNotifySettingsRequest%+vAccountToggleConnectedBotPausedRequest(nil)AuthImportWebTokenAuthorizationRequest(nil)BotsSetBotGroupDefaultAdminRightsRequest%+vChannelAdminLogEventActionChangeUsername%+vChannelAdminLogEventActionUpdatePinned(nil)ChannelAdminLogEventActionChangeLocation%+vChannelAdminLogEventActionToggleSlowMode%+vChannelAdminLogEventActionStartGroupCall%+vChannelAdminLogEventActionToggleAntiSpam%+vChannelsChannelParticipantsNotModified(nil)ChannelsGetChannelRecommendationsRequest%+vChannelsRestrictSponsoredMessagesRequest%+vChannelsToggleViewForumAsMessagesRequest%+vChannelsUpdatePaidMessagesPriceRequest(nil)InputPrivacyValueAllowChatParticipants(nil)InputStickerSetAnimatedEmojiAnimations(nil)MessagesCheckQuickReplyShortcutRequest(nil)MessagesDeleteScheduledMessagesRequest(nil)MessagesGetCustomEmojiDocumentsRequest(nil)MessagesGetEmojiKeywordsLanguagesRequest%+vMessagesGetInlineGameHighScoresRequest(nil)MessagesGetMessageReactionsListRequest(nil)MessagesGetSearchResultsPositionsRequest%+vMessagesGetSuggestedDialogFiltersRequest%+vMessagesHideAllChatJoinRequestsRequest(nil)MessagesReorderPinnedSavedDialogsRequest%+vMessagesSavePreparedInlineMessageRequest%+vMessagesSetChatAvailableReactionsRequest%+vMessagesStickerSetInstallResultSuccess(nil)MessagesStickerSetInstallResultArchive(nil)MessagesTogglePaidReactionPrivacyRequest%+vPaymentsAssignAppStoreTransactionRequest%+vPaymentsChangeStarsSubscriptionRequest(nil)PaymentsEditConnectedStarRefBotRequest(nil)PaymentsGetConnectedStarRefBotsRequest(nil)PaymentsGetPremiumGiftCodeOptionsRequest%+vPaymentsGetStarGiftActiveAuctionsRequest%+vPaymentsGetStarGiftAuctionStateRequest(nil)PaymentsGetStarGiftUpgradePreviewRequest%+vPaymentsGetStarsGiveawayOptionsRequest(nil)PaymentsGetSuggestedStarRefBotsRequest(nil)PaymentsStarGiftCollectionsNotModified(nil)PhoneGetGroupCallStreamChannelsRequest(nil)PhoneLeaveGroupCallPresentationRequest(nil)PhoneSaveDefaultGroupCallJoinAsRequest(nil)PhotosUploadContactProfilePhotoRequest(nil)edwards25519: invalid point encoding lengthspan on userArena.faultList has invalid sizesend on synctest channel from outside bubbleout of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddenheapInUse and consistent stats are not equaltotalFree and consistent stats are not equalmappedReady and other memstats are not equalcompileCallback: float results not supportedcannot trace user goroutine on its own stackunsafe.Slice: ptr is nil and len is not zerogolnk.CommonNetwork: read NetNameOffset - %sgolnk.VolumeID: read VolumeID.DriveType - %smult128bitPow10: power of 10 is out of rangeHARDWARE\DESCRIPTION\System\CentralProcessorfailed to get volume paths for volume %s: %wsevenzip: error seeking current position: %wsevenzip: error reading signature header: %w using value obtained using unexported fieldreflect: funcLayout with interface receiver reflect: slice length out of range in SetLenhttp: putIdleConn: too many idle connectionshttp2: could not negotiate protocol mutuallyhttp2: 1xx informational responses too largehttp: Request.ContentLength=%d with nil Bodycipher: NewGCM requires 128-bit block cipherx509: invalid RDNSequence: invalid attributex509: invalid Ed25519 private key parametersx509: invalid Ed25519 private key length: %dx509: internal error: cannot parse domain %qcrypto/x509: error fetching intermediate: %winsufficient data for calculated length typeskipping walk chromium path permission errortls: server's Finished message was incorrecttls: server sent an incorrect legacy versiontls: invalid server X25519MLKEM768 key sharetls: invalid X25519MLKEM768 server key share[WARN] yamux: Discarding data for stream: %d[ERR] yamux: received protocol error go away[ERR] yamux: received internal error go away[ERR] yamux: unexpected FIN flag in state %dcrypto/sha512: invalid hash state identifiercrypto/sha256: invalid hash state identifierencoding alphabet contains newline characterencoding alphabet includes duplicate symbolsmime: unexpected content after media subtypeinvalid Transfer-Encoding request header: %qunexpected argument type %q passed by sqliteliteral output size mismatch want %d, got %dinvalid decoding table, base overflows int32AccountChangeAuthorizationSettingsRequest%+vAccountGetCollectibleEmojiStatusesRequest%+vAccountUpdateBusinessAwayMessageRequest(nil)ChannelAdminLogEventActionToggleInvites(nil)ChannelAdminLogEventActionDeleteMessage(nil)ChannelAdminLogEventActionParticipantJoin%+vChannelAdminLogEventActionParticipantMute%+vChannelAdminLogEventActionChangeUsernames%+vChannelAdminLogEventActionChangePeerColor%+vChannelAdminLogEventActionChangeWallpaper%+vChannelsDeleteParticipantHistoryRequest(nil)ChannelsGetAdminedPublicChannelsRequest(nil)ChannelsToggleParticipantsHiddenRequest(nil)InputInvoiceStarGiftDropOriginalDetails(nil)InputPrivacyValueDisallowChatParticipants%+vMessagesDeleteExportedChatInviteRequest(nil)MessagesDeleteQuickReplyMessagesRequest(nil)MessagesDeleteQuickReplyShortcutRequest(nil)MessagesGetEmojiKeywordsDifferenceRequest%+vMessagesGetEmojiProfilePhotoGroupsRequest%+vMessagesGetFeaturedEmojiStickersRequest(nil)MessagesGetMessageReadParticipantsRequest%+vMessagesGetPreparedInlineMessageRequest(nil)MessagesGetSearchResultsCalendarRequest(nil)MessagesReorderPinnedForumTopicsRequest(nil)MessagesSendScreenshotNotificationRequest%+vMessagesSendWebViewResultMessageRequest(nil)MessagesSetBotPrecheckoutResultsRequest(nil)MessagesUpdateDialogFiltersOrderRequest(nil)PaymentsBotCancelStarsSubscriptionRequest%+vPaymentsCreateStarGiftCollectionRequest(nil)PaymentsDeleteStarGiftCollectionRequest(nil)PaymentsFulfillStarsSubscriptionRequest(nil)PaymentsGetStarGiftWithdrawalURLRequest(nil)PaymentsGetStarsTransactionsByIDRequest(nil)PaymentsGetUniqueStarGiftValueInfoRequest%+vPaymentsReorderStarGiftCollectionsRequest%+vPaymentsStarGiftActiveAuctionsNotModified%+vPaymentsToggleStarGiftsPinnedToTopRequest%+vPaymentsUpdateStarGiftCollectionRequest(nil)PhoneDeclineConferenceCallInviteRequest(nil)PhoneSendConferenceCallBroadcastRequest(nil)PhoneSendGroupCallEncryptedMessageRequest%+ved25519: bad Ed25519ph message hash length: leveldb/util.Buffer: truncation out of rangetable@build created L%d@%d N" (Indicator: "hardware\description\system\centralprocessor") in Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp34:Tba8,"_.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")35:T434,"readelf.exe" queries volume information of "C:\ProgramData\TO8zU\.crash" at 00000000-00002960-00000C17-1338160788 "readelf.exe" queries volume information of "C:\ProgramData\TO8zU\.crash" at 00000000-00003320-00000C17-1346417313 "readelf.exe" queries volume information of "C:\ProgramData\TO8zU\.crash" at 00000000-00003320-00000C17-1366792609 "readelf.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\abff69ec-0531-de64-d731-20f5c46bbe12.tmp" at 00000000-00003320-00000C17-1370458364 "readelf.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\abff69ec-0531-de64-d731-20f5c46bbe12.tmp" at 00000000-00003320-00000C17-1371417689 "readelf.exe" queries volume information of "C:\ProgramData\TO8zU\.crash" at 00000000-00004776-00000C17-1351280581 "readelf.exe" queries volume information of "C:\ProgramData\TO8zU\.crash" at 00000000-00004776-00000C17-1361341485 "readelf.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\abff69ec-0531-de64-d731-20f5c46bbe12.tmp" at 00000000-00004776-00000C17-136445098836:T4b1,"_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "_.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")37:T123a,"readelf.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002960) "readelf.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002960) "readelf.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002960) "readelf.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002960) "readelf.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002960) "readelf.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002960) "readelf.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00002960) "readelf.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002960) "readelf.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002960) "readelf.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002960) "readelf.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002960) "readelf.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002960) "readelf.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002960) "readelf.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002960) "readelf.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00003320) "readelf.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004776) "readelf.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004776)38:Tce33,"readelf.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetSystemTimes (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002960) "readelf.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetSystemTimes (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter ZwProtectVirtualMemory (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter FlushInstructionCache (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetErrorMode (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter IsDBCSLeadByteEx (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter OpenThread (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter RaiseFailFastException (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter RtlLookupFunctionEntry (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter Thread32First (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter Thread32Next (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter WerGetFlags (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter ___lc_codepage_func (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter ___mb_cur_max_func (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter __iob_func (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter _amsg_exit (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter _errno (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter _lock (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter _unlock (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter abort (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter fputc (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter localeconv (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter memset (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter realloc (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter strerror (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter strlen (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter vfprintf (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter wcslen (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter IsClipboardFormatAvailable (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter OpenClipboard (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CloseClipboard (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter EmptyClipboard (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetClipboardData (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SetClipboardData (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetModuleBaseNameA (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter SetWindowsHookExW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter CallNextHookEx (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter GetAsyncKeyState (UID: 00000000-00003320) "readelf.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetSystemTimes (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter ZwProtectVirtualMemory (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter FlushInstructionCache (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetErrorMode (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter IsDBCSLeadByteEx (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter OpenThread (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter RaiseFailFastException (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter RtlLookupFunctionEntry (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter Thread32First (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter Thread32Next (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter WerGetFlags (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter ___lc_codepage_func (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter ___mb_cur_max_func (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter __iob_func (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter _amsg_exit (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter _errno (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter _lock (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter _unlock (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter abort (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter fputc (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter localeconv (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter memset (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter realloc (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter strerror (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter strlen (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter vfprintf (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter wcslen (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter IsClipboardFormatAvailable (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter OpenClipboard (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CloseClipboard (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter EmptyClipboard (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetClipboardData (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SetClipboardData (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetModuleBaseNameA (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter SetWindowsHookExW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter CallNextHookEx (UID: 00000000-00004776) "readelf.exe" called "GetProcAddress" with a parameter GetAsyncKeyState (UID: 00000000-00004776)39:T1eae,"SELECT*FROM"%w".%s WHERE %s ORDER BY rowid" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "select*from"%w".%s where %s order by rowid") "SELECT 1 FROM "%w".sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, %d, %Q, %d)=NULL" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "select 1 from "%w".sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, %d, %q, %d)=null"), "SELECT 1 FROM temp.sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, 1, %Q, %d)=NULL" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "select 1 from temp.sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, 1, %q, %d)=null"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_quotefix(%Q, sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_quotefix(%q, sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_quotefix('temp', sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "update temp.sqlite_master set sql = sqlite_rename_quotefix('temp', sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, %d) WHERE (type!='index' OR tbl_name=%Q COLLATE nocase)AND name NOT LIKE 'sqliteX_%%' ESCAPE 'X'" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, %d) where (type!='index' or tbl_name=%q collate nocase)and name not like 'sqlitex_%%' escape 'x'"), "UPDATE %Q.sqlite_master SET tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "update %q.sqlite_master set tbl_name = %q name = case when type='table' then %q when name like 'sqlitex_autoindex%%' escape 'x' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q collate nocase and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "update "%w".sqlite_sequence set name = %q where name = %q"), "UPDATE sqlite_temp_schema SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, 1) tbl_name = CASE WHEN tbl_name=%Q COLLATE nocase AND sqlite_rename_test(%Q, sql, type, name, 1, 'after rename', 0) THEN %Q ELSE tbl_name END WHERE type IN ('view', 'trigger')" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "update sqlite_temp_schema set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, 1) tbl_name = case when tbl_name=%q collate nocase and sqlite_rename_test(%q, sql, type, name, 1, 'after rename', 0) then %q else tbl_name end where type in ('view', 'trigger')"), "SELECT raise(ABORT,%Q) FROM "%w"."%w"" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "select raise(abort,%q) from "%w"."%w""), "UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "update "%w".sqlite_master set sql = printf('%%.%ds, ',sql) || %q || substr(sql,1+length(printf('%%.%ds',sql))) where type = 'table' and name = %q"), "SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*' OR quick_check GLOB 'non-* value in*'" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "select case when quick_check glob 'check*' then raise(abort,'check constraint failed') when quick_check glob 'non-* value in*' then raise(abort,'type mismatch on default') else raise(abort,'not null constraint failed') end from pragma_quick_check(%q,%q) where quick_check glob 'check*' or quick_check glob 'null*' or quick_check glob 'non-* value in*'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, %d) WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND (type != 'index' OR tbl_name = %Q)" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, %d) where name not like 'sqlitex_%%' escape 'x' and (type != 'index' or tbl_name = %q)"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, 1) WHERE type IN ('trigger', 'view')" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "update temp.sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, 1) where type in ('trigger', 'view')"), "UPDATE "%w".sqlite_master SET sql = sqlite_drop_column(%d, sql, %d) WHERE (type=='table' AND tbl_name=%Q COLLATE nocase)" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "update "%w".sqlite_master set sql = sqlite_drop_column(%d, sql, %d) where (type=='table' and tbl_name=%q collate nocase)"), "CREATE TABLE %Q.%s(%s)" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "create table %q.%s(%s)"), "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "delete from %q.%s where %s=%q"), "DELETE FROM %Q.%s" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "delete from %q.%s"), "SELECT idx count(*) FROM %Q.sqlite_stat4 GROUP BY idx COLLATE nocase" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "select idx count(*) from %q.sqlite_stat4 group by idx collate nocase"), "SELECT idx neq nlt ndlt sample FROM %Q.sqlite_stat4" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "select idx neq nlt ndlt sample from %q.sqlite_stat4"), "SELECT tbl idx stat FROM %Q.sqlite_stat1" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "select tbl idx stat from %q.sqlite_stat1"), "CREATE TABLE" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "create table"), "UPDATE %Q.sqlite_master SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "update %q.sqlite_master set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "CREATE TABLE %Q.sqlite_sequence(name,seq)" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "create table %q.sqlite_sequence(name,seq)"), "SELECT*FROM"%w"."%w"" (Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, Indicator: "select*from"%w"."%w"")3a:T4fb,Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp, 00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") file/memory contains long string with (Indicator: "CreateFile"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "NtCreateFile"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp")3b:T5afe,Found reference to API (Indicator: "WSAIoctl"; File: ".exe") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00002960.00000000.149893.1A900000.00000004.mdmp, 00000000-00002960.00000001.150097.1A900000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "CharLowerW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp, 00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp, 00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp, 00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp, 00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "HeapCompact"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp, 00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "UnlockFile"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "UnlockFileEx"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "CreateFile2"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "UuidCreateSequential"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "CreateEvent"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "CancelIo"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleA"; Source: "00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00003320.00000000.150394.4D0D0000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleA"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp, 00000000-00003320.00000002.154236.65EAC000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003320.00000002.154236.65EAC000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003320.00000002.154236.65EAC000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00004776.00000000.150753.FBFD0000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00004776.00000000.150753.FBFD0000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004776.00000000.150753.FBFD0000.00000004.mdmp") Found reference to API (Indicator: "AddVectoredContinueHandler"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "CreateWaitableTimerExW"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "GetErrorMode"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "OpenThread"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "RaiseFailFastException"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "SetProcessPriorityBoost"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "Thread32First"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "Thread32Next"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "WerGetFlags"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "WerSetFlags"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp")3c:T442,file/memory contains long string with (Indicator: "OpenThread"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "ResumeThread"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp")3d:Tba1,Antivirus vendors marked dropped file "readelf.exe" as clean (type is "PE32+ executable for MS Windows 5.02 (console) x86-64 (stripped to external PDB) 11 sections"), Antivirus vendors marked dropped file "msvcp140.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "vcruntime140.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-private-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"), Antivirus vendors marked dropped file "vcruntime140_1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-math-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"), Antivirus vendors marked dropped file "api-ms-win-core-winrt-string-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-multibyte-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"), Antivirus vendors marked dropped file "api-ms-win-core-winrt-error-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-core-winrt-error-l1-1-1.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "api-ms-win-core-xstate-l2-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"), Antivirus vendors marked dropped file "api-ms-win-core-xstate-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-string-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-stdio-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-runtime-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"), Antivirus vendors marked dropped file "api-ms-win-crt-convert-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"), Antivirus vendors marked dropped file "api-ms-win-core-file-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"), Antivirus vendors marked dropped file "api-ms-win-core-localization-l1-2-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"), Antivirus vendors marked dropped file "api-ms-win-core-processthreads-l1-1-0.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections")3e:Tfac,"JhwRME7kax.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "readelf.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "msvcp140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "vcruntime140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-private-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "vcruntime140_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-math-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-winrt-string-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "api-ms-win-crt-multibyte-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-winrt-error-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "api-ms-win-core-winrt-error-l1-1-1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "api-ms-win-core-xstate-l2-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "api-ms-win-core-xstate-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "api-ms-win-crt-string-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-stdio-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-runtime-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-convert-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-file-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-localization-l1-2-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-core-processthreads-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "api-ms-win-crt-time-l1-1-0.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF3f:T4f10,"/memory/classes/metadata/mspan/free:bytesruntime.SetFinalizer: second argument is gcSweep being done but phase is not GCoffobjects added out of order or overlappingmheap.freeSpanLocked - invalid stack freemheap.freeSpanLocked - invalid span stateattempted to add zero-sized address rangeruntime: blocked read on closing polldescruntime: SetWaitableTimer failed; errno= stopTheWorld: not stopped (stopwait != 0)invalid timer: fake time but no syncgrouptime: Reset called on uninitialized Timertime: missing Location in call to Time.InTime.UnmarshalBinary: unsupported versionbytes.Buffer.WriteTo: invalid Write countbytes.Reader.WriteTo: invalid Write countbinary: varint overflows a 64-bit integergolnk.readSection: invalid sSize - got %vlnk.header: reading target file size - %s34694469519536141888238489627838134765625strconv: illegal AppendInt/FormatInt base/AppData/Local/Vivaldi/User Data/Default/jpeg: fill called when unread bytes existfailed to get logical processor count: %wSYSTEM\CurrentControlSet\Services\PartMgrcan't call pointer on a non-pointer Valuecrypto/md5: invalid hash state identifierMapIter.Next called on exhausted iteratorreflect.Value.Addr of unaddressable valueRSASSA-PKCS-v1.5 2048-bit sign and verifyhttp2: no cached connection was availablehttp2: Transport health check failure: %vtransport got GOAWAY with error code = %vmsgpack: invalid code=%x decoding float32%s len is %d, but msgpack has %d elementsmsgpack: invalid code=%x decoding ext lenmsgpack: invalid ext len=%d decoding timex509: cannot parse URI %q: invalid domainchacha8: key length must be KeySize bytesarchive/zip: invalid duplicate FileHeadercolon must be followed by more characterserror creating ASN1PBE from metaItem2: %wlength of final key is less than 24 bytesencoding: rune not supported by encoding.tls: internal error: unsupported key (%T)invalid value length: expected %d, got %d[ERR] yamux: Invalid protocol version: %dhash/crc32: invalid hash state identifierlzma: dictionary capacity is out of rangefips140: unknown GODEBUG setting fips140=net/url: invalid control character in URLidna: internal error in punycode encodingasn1: internal error in parseTagAndLength%s slice too big: %d elements of %d bytescorrupted input (position=%d, expected 0)AccountClearRecentEmojiStatusesRequest%+vAccountCreateBusinessChatLinkRequest(nil)AccountDeleteAutoSaveExceptionsRequest%+vAccountDeleteBusinessChatLinkRequest(nil)AccountGetBotBusinessConnectionRequest%+vAccountGetGlobalPrivacySettingsRequest%+vAccountGetPaidMessagesRevenueRequest(nil)AccountGetRecentEmojiStatusesRequest(nil)AccountResetWebAuthorizationsRequest(nil)AccountSaveAutoDownloadSettingsRequest%+vAccountSetGlobalPrivacySettingsRequest%+vAccountToggleConnectedBotPausedRequest%+vAccountUpdateBusinessLocationRequest(nil)AccountUpdatePasswordSettingsRequest(nil)AuthImportWebTokenAuthorizationRequest%+vBotsInvokeWebViewCustomMethodRequest(nil)ChannelAdminLogEventActionUpdatePinned%+vChannelsChannelParticipantsNotModified%+vChannelsCheckSearchPostsFloodRequest(nil)ChannelsToggleAutotranslationRequest(nil)ChannelsUpdatePaidMessagesPriceRequest%+vChatlistsDeleteExportedInviteRequest(nil)ChatlistsExportChatlistInviteRequest(nil)GroupCallParticipantVideoSourceGroup(nil)InputInvoiceBusinessBotTransferStars(nil)InputPrivacyValueAllowChatParticipants%+vInputStickerSetAnimatedEmojiAnimations%+vInputStorePaymentPremiumSubscription(nil)InvokeWithGooglePlayIntegrityRequest(nil)MessagesCheckQuickReplyShortcutRequest%+vMessagesClickSponsoredMessageRequest(nil)MessagesDeleteScheduledMessagesRequest%+vMessagesGetAvailableReactionsRequest(nil)MessagesGetCustomEmojiDocumentsRequest%+vMessagesGetEmojiStickerGroupsRequest(nil)MessagesGetExportedChatInviteRequest(nil)MessagesGetInlineGameHighScoresRequest%+vMessagesGetMessageReactionsListRequest%+vMessagesGetPinnedSavedDialogsRequest(nil)MessagesGetQuickReplyMessagesRequest(nil)MessagesHideAllChatJoinRequestsRequest%+vMessagesSavedReactionTagsNotModified(nil)MessagesSendScheduledMessagesRequest(nil)MessagesSetBotShippingResultsRequest(nil)MessagesStickerSetInstallResultSuccess%+vMessagesStickerSetInstallResultArchive%+vMessagesToggleBotInAttachMenuRequest(nil)PaymentsChangeStarsSubscriptionRequest%+vPaymentsEditConnectedStarRefBotRequest%+vPaymentsGetConnectedStarRefBotsRequest%+vPaymentsGetStarGiftAuctionStateRequest%+vPaymentsGetStarsGiveawayOptionsRequest%+vPaymentsGetStarsSubscriptionsRequest(nil)PaymentsGetSuggestedStarRefBotsRequest%+vPaymentsLaunchPrepaidGiveawayRequest(nil)PaymentsStarGiftAuctionAcquiredGifts(nil)PaymentsStarGiftCollectionsNotModified%+vPaymentsValidateRequestedInfoRequest(nil)PhoneEditGroupCallParticipantRequest(nil)PhoneGetGroupCallStreamChannelsRequest%+vPhoneLeaveGroupCallPresentationRequest%+vPhoneSaveDefaultGroupCallJoinAsRequest%+vPhotosUploadContactProfilePhotoRequest%+vPrivacyValueDisallowChatParticipants(nil)SecureValueTypeTemporaryRegistration(nil)StatsGetMessagePublicForwardsRequest(nil)StickersChangeStickerPositionRequest(nil)StoriesToggleAllStoriesHiddenRequest(nil)UsersGetRequirementsToContactRequest(nil)GODEBUG sys/cpu: no value specified for "leveldb/storage: open %s: not a directoryBUG: invalid LRU used or capacity counterruntime.AddCleanup: ptr is arena-allocatedsync/atomic: store of nil value into Value bytes; incompatible with mutex flag mask persistentalloc: align is not a power of 2/cpu/classes/gc/mark/dedicated:cpu-seconds/memory/classes/metadata/mcache/free:bytes/memory/classes/metadata/mspan/inuse:bytesnon-empty mark queue after concurrent marksweep: tried to preserve a user arena spanruntime: blocked write on closing polldescunexpected state passed to panicrangestateacquireSudog: found s.elem != nil in cachefatal error: cgo callback before cgo call" in Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, " but it's notcorrupt input: last value not power of twoleveldb/storage: invalid file for argumentinterrupted system call should be restarted/memory/classes/metadata/mcache/inuse:bytesruntime.SetFinalizer: first argument is nilruntime.SetFinalizer: finalizer already setgcBgMarkWorker: unexpected gcMarkWorkerModenon in-use span found with specials bit setgrew heap, but no adequate free space foundroot level max pages doesn't fit in summarymeasures of the retained heap are not equalruntime.Pinner: argument is not a pointer: runtime: releaseSudog with non-nil gp.paramunknown runnable goroutine during bootstrapruntime: casfrom_Gscanstatus bad oldval gp=runtime:stoplockedm: lockedg (atomicstatus=methodValueCallFrameObjs is not in a modulereset of synctest timer from outside bubblesynctest timer accessed from outside bubbleResizePseudoConsole failed with status 0x%xInitializeProcThreadAttributeList not foundlnk.header: error reading magic string - %slnk.LinkInfo: read LocalBasePathOffset - %sexec: WaitDelay expired before I/O completemult64bitPow10: power of 10 is out of range/AppData/Local/DCBrowser/User Data/Default/bufio: tried to rewind past start of buffermultiple Read calls return no data or errortransform: inconsistent byte count returnedsevenzip: unsupported compression algorithmreflect: nil type passed to Type.Implementshttp2: client conn could not be establishednet/http: timeout awaiting response headershttp2: unexpected ALPN protocol %q; want %qTransport: unhandled response frame type %TError enabling Transport HTTP/2 support: %vx509: failed to parse dnsName constraint %qx509: invalid X25519 private key parametersskipping walk firefox path permission errortls: received unexpected key update messagetls: no supported elliptic curves for ECDHEtls: server did not select an ALPN protocoltls: server sent unrequested session tickettls: received malformed key_share extensiontls: invalid early data for QUIC connection[ERR] socks: Failed to get version byte: %v[WARN] yamux: failed to send ping reply: %v[ERR] yamux: Failed to read stream data: %vimpl: package name must not contain slasheschunked encoding contains too much non-datahash/adler32: invalid hash state identifierexplicit time type given to non-time membersql: connection returned that was never outlzma.unmarshalBinary: data has wrong lengthAccountClearRecentEmojiStatusesRequest(nil)AccountDeleteAutoSaveExceptionsRequest(nil)AccountGetBotBusinessConnectionRequest(nil)AccountGetDefaultBackgroundEmojisRequest%+vAccountGetDefaultGroupPhotoEmojisRequest%+vAccountGetGlobalPrivacySettingsRequest(nil)AccountGetReactionsNotifySettingsRequest%+vAccountSaveAutoDownloadSettingsRequest(nil)AccountSetGlobalPrivacySettingsRequest(nil)AccountSetReactionsNotifySettingsRequest%+vAccountToggleConnectedBotPausedRequest(nil)AuthImportWebTokenAuthorizationRequest(nil)BotsSetBotGroupDefaultAdminRightsRequest%+vChannelAdminLogEventActionChangeUsername%+vChannelAdminLogEventActionUpdatePinned(nil)ChannelAdminLogEventActionChangeLocation%+vChannelAdminLogEventActionToggleSlowMode%+vChannelAdminLogEventActionStartGroupCall%+vChannelAdminLogEventActionToggleAntiSpam%+vChannelsChannelParticipantsNotModified(nil)ChannelsGetChannelRecommendationsRequest%+vChannelsRestrictSponsoredMessagesRequest%+vChannelsToggleViewForumAsMessagesRequest%+vChannelsUpdatePaidMessagesPriceRequest(nil)InputPrivacyValueAllowChatParticipants(nil)InputStickerSetAnimatedEmojiAnimations(nil)MessagesCheckQuickReplyShortcutRequest(nil)MessagesDeleteScheduledMessagesRequest(nil)MessagesGetCustomEmojiDocumentsRequest(nil)MessagesGetEmojiKeywordsLanguagesRequest%+vMessagesGetInlineGameHighScoresRequest(nil)MessagesGetMessageReactionsListRequest(nil)MessagesGetSearchResultsPositionsRequest%+vMessagesGetSuggestedDialogFiltersRequest%+vMessagesHideAllChatJoinRequestsRequest(nil)MessagesReorderPinnedSavedDialogsRequest%+vMessagesSavePreparedInlineMessageRequest%+vMessagesSetChatAvailableReactionsRequest%+vMessagesStickerSetInstallResultSuccess(nil)MessagesStickerSetInstallResultArchive(nil)MessagesTogglePaidReactionPrivacyRequest%+vPaymentsAssignAppStoreTransactionRequest%+vPaymentsChangeStarsSubscriptionRequest(nil)PaymentsEditConnectedStarRefBotRequest(nil)PaymentsGetConnectedStarRefBotsRequest(nil)PaymentsGetPremiumGiftCodeOptionsRequest%+vPaymentsGetStarGiftActiveAuctionsRequest%+vPaymentsGetStarGiftAuctionStateRequest(nil)PaymentsGetStarGiftUpgradePreviewRequest%+vPaymentsGetStarsGiveawayOptionsRequest(nil)PaymentsGetSuggestedStarRefBotsRequest(nil)PaymentsStarGiftCollectionsNotModified(nil)PhoneGetGroupCallStreamChannelsRequest(nil)PhoneLeaveGroupCallPresentationRequest(nil)PhoneSaveDefaultGroupCallJoinAsRequest(nil)PhotosUploadContactProfilePhotoRequest(nil)edwards25519: invalid point encoding lengthspan on userArena.faultList has invalid sizesend on synctest channel from outside bubbleout of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available write barriers are forbiddenheapInUse and consistent stats are not equaltotalFree and consistent stats are not equalmappedReady and other memstats are not equalcompileCallback: float results not supportedcannot trace user goroutine on its own stackunsafe.Slice: ptr is nil and len is not zerogolnk.CommonNetwork: read NetNameOffset - %sgolnk.VolumeID: read VolumeID.DriveType - %smult128bitPow10: power of 10 is out of rangeHARDWARE\DESCRIPTION\System\CentralProcessorfailed to get volume paths for volume %s: %wsevenzip: error seeking current position: %wsevenzip: error reading signature header: %w using value obtained using unexported fieldreflect: funcLayout with interface receiver reflect: slice length out of range in SetLenhttp: putIdleConn: too many idle connectionshttp2: could not negotiate protocol mutuallyhttp2: 1xx informational responses too largehttp: Request.ContentLength=%d with nil Bodycipher: NewGCM requires 128-bit block cipherx509: invalid RDNSequence: invalid attributex509: invalid Ed25519 private key parametersx509: invalid Ed25519 private key length: %dx509: internal error: cannot parse domain %qcrypto/x509: error fetching intermediate: %winsufficient data for calculated length typeskipping walk chromium path permission errortls: server's Finished message was incorrecttls: server sent an incorrect legacy versiontls: invalid server X25519MLKEM768 key sharetls: invalid X25519MLKEM768 server key share[WARN] yamux: Discarding data for stream: %d[ERR] yamux: received protocol error go away[ERR] yamux: received internal error go away[ERR] yamux: unexpected FIN flag in state %dcrypto/sha512: invalid hash state identifiercrypto/sha256: invalid hash state identifierencoding alphabet contains newline characterencoding alphabet includes duplicate symbolsmime: unexpected content after media subtypeinvalid Transfer-Encoding request header: %qunexpected argument type %q passed by sqliteliteral output size mismatch want %d, got %dinvalid decoding table, base overflows int32AccountChangeAuthorizationSettingsRequest%+vAccountGetCollectibleEmojiStatusesRequest%+vAccountUpdateBusinessAwayMessageRequest(nil)ChannelAdminLogEventActionToggleInvites(nil)ChannelAdminLogEventActionDeleteMessage(nil)ChannelAdminLogEventActionParticipantJoin%+vChannelAdminLogEventActionParticipantMute%+vChannelAdminLogEventActionChangeUsernames%+vChannelAdminLogEventActionChangePeerColor%+vChannelAdminLogEventActionChangeWallpaper%+vChannelsDeleteParticipantHistoryRequest(nil)ChannelsGetAdminedPublicChannelsRequest(nil)ChannelsToggleParticipantsHiddenRequest(nil)InputInvoiceStarGiftDropOriginalDetails(nil)InputPrivacyValueDisallowChatParticipants%+vMessagesDeleteExportedChatInviteRequest(nil)MessagesDeleteQuickReplyMessagesRequest(nil)MessagesDeleteQuickReplyShortcutRequest(nil)MessagesGetEmojiKeywordsDifferenceRequest%+vMessagesGetEmojiProfilePhotoGroupsRequest%+vMessagesGetFeaturedEmojiStickersRequest(nil)MessagesGetMessageReadParticipantsRequest%+vMessagesGetPreparedInlineMessageRequest(nil)MessagesGetSearchResultsCalendarRequest(nil)MessagesReorderPinnedForumTopicsRequest(nil)MessagesSendScreenshotNotificationRequest%+vMessagesSendWebViewResultMessageRequest(nil)MessagesSetBotPrecheckoutResultsRequest(nil)MessagesUpdateDialogFiltersOrderRequest(nil)PaymentsBotCancelStarsSubscriptionRequest%+vPaymentsCreateStarGiftCollectionRequest(nil)PaymentsDeleteStarGiftCollectionRequest(nil)PaymentsFulfillStarsSubscriptionRequest(nil)PaymentsGetStarGiftWithdrawalURLRequest(nil)PaymentsGetStarsTransactionsByIDRequest(nil)PaymentsGetUniqueStarGiftValueInfoRequest%+vPaymentsReorderStarGiftCollectionsRequest%+vPaymentsStarGiftActiveAuctionsNotModified%+vPaymentsToggleStarGiftsPinnedToTopRequest%+vPaymentsUpdateStarGiftCollectionRequest(nil)PhoneDeclineConferenceCallInviteRequest(nil)PhoneSendConferenceCallBroadcastRequest(nil)PhoneSendGroupCallEncryptedMessageRequest%+ved25519: bad Ed25519ph message hash length: leveldb/util.Buffer: truncation out of rangetable@build created L%d@%d N" in Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, "bytes.Buffer: reader returned negative count from Readbinary.Write: some values are not fixed-sized in type fmt: scanning called UnreadRune with no rune availablegolnk.CommonNetwork: read DeviceNameOffsetUnicode - %s/AppData/Local/Yandex/YandexBrowser/User Data/Default/error getting times for cpu percent. lastTimes was nilhttp: Request.Write on Request with no Host or URL setread loop ending; caller owns writable underlying connnet/http: can't write control character in Request.URLx509: cannot verify signature: algorithm unimplementedx509: invalid RDNSequence: invalid attribute value: %sURI with IP (%q) cannot be matched against constraintscryptobyte: Builder is exceeding its fixed-size buffername is not in canonical format (it must end with a .)tls: server resumed a session with a different versiontls: server accepted 0-RTT with the wrong cipher suitetls: certificate used with invalid signature algorithmtls: found unknown private key type in PKCS#8 wrappingecdsa: curve not supported by deterministic signaturessql: expected %d destination arguments in Scan not %dlz4: cannot apply options on closed or in error objectliteral block was treeless but no history was definedinvalid decoding table entry %d symbol %d >= max (%d)ChannelAdminLogEventActionParticipantJoinByInvite(nil)ChannelAdminLogEventActionToggleSignatureProfiles(nil)panic calling String method on zero %v for flag %s: %vinternal error: negative process handle reference countmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zoneslnk.LinkInfo: read CommonNetworkRelativeLinkOffset - %sbufio.Scanner: SplitFunc returns negative advance countprogressive AC coefficients for more than one componentreflect: internal error: invalid use of makeMethodValuenet/http: request canceled while waiting for connectionnet/http: invalid byte %q in %s; dropping invalid byteshttp2: Transport received GOAWAY from server ErrCode:%vcipher.NewCBCEncrypter: IV length must equal block sizecipher.NewCBCDecrypter: IV length must equal block sizex509: authority info access incorrectly marked criticalx509: too many intermediates for path length constraintx509: failed to load system roots and no roots providedeach colon-separated field must have at least one digitSELECT item1 item2 FROM metaData WHERE id = 'password'tls: internal error: handshake should have had a resulttls: server sent non-zero legacy TLS compression methodrequest header list larger than peer's advertised limitecdsa: internal error: shift can only be by 1 to 7 bitssql: Scan called without calling Next (closemuScanHold)noStateerrorStatenewStatereadStatewriteStateclosedStatematch offset (%d) bigger than current history+dict (%d)ChannelAdminLogEventActionParticipantJoinByRequest(nil)ChannelAdminLogEventActionChangeAvailableReactions(nil)edwards25519: invalid SetBytesWithClamping input lengthlanguage: different values for same key in -u extensionstrings: illegal use of non-zero Builder copied by valuerange function continued iteration after loop body panicrange function continued iteration after whole loop exitfailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= semaphore wake of synctest goroutine from outside bubble" in Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, "internal error: exactly one of res or err should be set; nil=%vcrypto/ecdh: use of X25519 is not allowed in FIPS 140-only modetls: unexpected encrypted client hello extension in serverHellocrypto/ecdh: internal error: public key is the identity elementcryptobyte: BuilderContinuation reallocated a fixed-size bufferleveldb/table: Writer: keys are not in increasing order: %q %qSoftware\Microsoft\Windows\CurrentVersion\Explorer\Shell Foldersruntime.SetFinalizer: first argument was allocated into an arenacompileCallback: expected function with one uintptr-sized resultattempted to trace stack of a goroutine this thread does not own0000000000000000000000000000000000000000000000000000000000000000 go package net: GODEBUG setting forcing use of the cgo resolver" in Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp, "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005572.00000000.149596.411F0000.00000004.mdmp, "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00005572.00000000.149596.411F0000.00000004.mdmp, "21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005572.00000001.151116.411F0000.00000004.mdmp, "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005572.00000001.151116.411F0000.00000004.mdmp40:T8aa,"readelf.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ff8a8e70000 "readelf.exe" loaded module "NTDLL.DLL" at base 7ff8aba20000 "readelf.exe" loaded module "KERNEL32" at base 7ff8aae20000 "readelf.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff8a7e20000 "readelf.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff8a7e20000 "readelf.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff8a7e20000 "readelf.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 2141aad0000 "readelf.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8a7e20000 "readelf.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8a7e20000 "readelf.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8a7e20000 "readelf.exe" loaded module "WINMM.DLL" at base 7ff8a00b0000 "readelf.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff87b580000 "readelf.exe" loaded module "POWRPROF.DLL" at base 7ff8a7d70000 "readelf.exe" loaded module "KERNEL32.DLL" at base 7ff8aae20000 "readelf.exe" loaded module "WS2_32.DLL" at base 7ff8a8f20000 "readelf.exe" loaded module "ADVAPI32.DLL" at base 7ff8ab100000 "readelf.exe" loaded module "RPCRT4.DLL" at base 7ff8ab260000 "readelf.exe" loaded module "OLE32.DLL" at base 7ff8aaf30000 "readelf.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8a63f0000 "readelf.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 7ff8a3770000 "readelf.exe" loaded module "OLEAUT32.DLL" at base 7ff8ab530000 "readelf.exe" loaded module "SSPICLI.DLL" at base 7ff8a7c70000 "readelf.exe" loaded module "PSAPI.DLL" at base 7ff8ab380000 "readelf.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 2af4d2d0000 "readelf.exe" loaded module "USER32.DLL" at base 7ff8a93f0000 "readelf.exe" loaded module "MSVCRT.DLL" at base 7ff8a9590000 "readelf.exe" loaded module "USER32" at base 7ff8a93f0000 "readelf.exe" loaded module "GDI32.DLL" at base 7ff8aaa70000 "readelf.exe" loaded module "IPHLPAPI.DLL" at base 7ff8a7330000 "readelf.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff8a75a0000 "readelf.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 264fbf9000041:T7ec,"readelf.exe" called "Schedule.Service.1.CreateObject" ... "readelf.exe" called "Schedule.Service.1.Connect" ... "readelf.exe" called "Schedule.Service.1.GetFolder" with result: "\" ... "readelf.exe" called "Schedule.Service.1.NewTask" with result: "IDispatch" ... "readelf.exe" called "Schedule.Service.1("NewTask").Triggers" with result: "IDispatch" ... "readelf.exe" called "Schedule.Service.1("NewTask")("Triggers").Create" with result: "IDispatch" ... "readelf.exe" called "Schedule.Service.1("NewTask")("Triggers")("Create").StartBoundary" ... "readelf.exe" called "Schedule.Service.1("NewTask")("Triggers")("Create").Repetition" with result: "IDispatch" ... "readelf.exe" called "Schedule.Service.1("NewTask")("Triggers")("Create")("Repetition").Interval" ... "readelf.exe" called "Schedule.Service.1("NewTask")("Triggers")("Create")("Repetition").Duration" ... "readelf.exe" called "Schedule.Service.1("NewTask").Actions" with result: "IDispatch" ... "readelf.exe" called "Schedule.Service.1("NewTask")("Actions").Create" with result: "IDispatch" ... "readelf.exe" called "Schedule.Service.1("NewTask")("Actions")("Create").Path" ... "readelf.exe" called "Schedule.Service.1("NewTask").Principal" with result: "IDispatch" ... "readelf.exe" called "Schedule.Service.1("NewTask")("Principal").UserId" ... "readelf.exe" called "Schedule.Service.1("NewTask")("Principal").LogonType" ... "readelf.exe" called "Schedule.Service.1("NewTask")("Principal").RunLevel" ... "readelf.exe" called "Schedule.Service.1("NewTask").Settings" with result: "IDispatch" ... "readelf.exe" called "Schedule.Service.1("NewTask")("Settings").ExecutionTimeLimit" ... "readelf.exe" called "Schedule.Service.1("NewTask")("Settings").StartWhenAvailable" ... "readelf.exe" called "Schedule.Service.1("GetFolder").RegisterTaskDefinition" with result: "\a6Bum" ... "readelf.exe" called "Schedule.Service.1("NewTask").Unnamed" ... "readelf.exe" called "Schedule.Service.1("GetFolder").GetTask" with result: "\a6Bum" ...42:T678,".exe" was detected as "Go" and name: "Compiler" "JhwRME7kax.dll" was detected as "Go" and name: "Compiler" "readelf.exe" was detected as "Go" and name: "Compiler" "msvcp140.dll" was detected as "Go" and name: "Compiler" "vcruntime140.dll" was detected as "Go" and name: "Compiler" "api-ms-win-crt-private-l1-1-0.dll" was detected as "Go" and name: "Compiler" "vcruntime140_1.dll" was detected as "Go" and name: "Compiler" "api-ms-win-crt-math-l1-1-0.dll" was detected as "Go" and name: "Compiler" "api-ms-win-core-winrt-string-l1-1-0.dll" was detected as "Go" and name: "Compiler" "api-ms-win-crt-multibyte-l1-1-0.dll" was detected as "Go" and name: "Compiler" "api-ms-win-core-winrt-error-l1-1-0.dll" was detected as "Go" and name: "Compiler" "api-ms-win-core-winrt-error-l1-1-1.dll" was detected as "Go" and name: "Compiler" "api-ms-win-core-xstate-l2-1-0.dll" was detected as "Go" and name: "Compiler" "api-ms-win-core-xstate-l1-1-0.dll" was detected as "Go" and name: "Compiler" "api-ms-win-crt-string-l1-1-0.dll" was detected as "Go" and name: "Compiler" "api-ms-win-crt-stdio-l1-1-0.dll" was detected as "Go" and name: "Compiler" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "Go" and name: "Compiler" "api-ms-win-crt-convert-l1-1-0.dll" was detected as "Go" and name: "Compiler" "api-ms-win-core-file-l1-1-0.dll" was detected as "Go" and name: "Compiler" "api-ms-win-core-localization-l1-2-0.dll" was detected as "Go" and name: "Compiler" "api-ms-win-core-processthreads-l1-1-0.dll" was detected as "Go" and name: "Compiler" "api-ms-win-crt-time-l1-1-0.dll" was detected as "Go" and name: "Compiler"43:T3505,Process "msedge.exe" (UID: 00000000-00003588) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, COMPONENT_INSTALLER_DIR, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00006884) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_1728_CPTHCSJXRDKJPCGN", EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753", EDGE_BROWSER_PID="1728"" Process "msedge.exe" (UID: 00000000-00004172) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00006216) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "_.exe" (UID: 00000000-00005572) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="NuzX2niUukmFUcb", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="RmZ1L6g", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="NuzX2niUukmFUcb", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\RmZ1L6g", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\RmZ1L6g", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "_.exe" (UID: 00000000-00005572) was launched with modified environment variables: "Path" Process "_.exe" (UID: 00000000-00005572) was launched with missing environment variables: "EDGE_CRASHPAD_PIPE_NAME, COMPONENT_INSTALLER_DIR, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007916) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_1728_CPTHCSJXRDKJPCGN", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="1728"" Process "msedge.exe" (UID: 00000000-00007916) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00007916) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "readelf.exe" (UID: 00000000-00002960) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="NuzX2niUukmFUcb", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="RmZ1L6g", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="NuzX2niUukmFUcb", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\RmZ1L6g", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\RmZ1L6g", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "readelf.exe" (UID: 00000000-00002960) was launched with modified environment variables: "Path" Process "readelf.exe" (UID: 00000000-00002960) was launched with missing environment variables: "EDGE_CRASHPAD_PIPE_NAME, COMPONENT_INSTALLER_DIR, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00001152) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_1728_CPTHCSJXRDKJPCGN", EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERDNSDOMAIN="DESKTOP-FVVF82A", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753", EDGE_BROWSER_PID="1728"" Process "msedge.exe" (UID: 00000000-00001152) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00002044) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00006748) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="NuzX2niUukmFUcb", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="RmZ1L6g", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="NuzX2niUukmFUcb", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\RmZ1L6g", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\RmZ1L6g", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00005552) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00003624) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="NuzX2niUukmFUcb", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="RmZ1L6g", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="NuzX2niUukmFUcb", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\RmZ1L6g", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\RmZ1L6g", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00006952) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00006428) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="NuzX2niUukmFUcb", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="RmZ1L6g", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="NuzX2niUukmFUcb", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\RmZ1L6g", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\RmZ1L6g", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00007604) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH"44:Tcac,Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00003588), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00006884), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004172), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00006216), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00004248), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00004216), Spawned process "_.exe" (UID: 00000000-00005572), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00007916), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00006856), Spawned process "readelf.exe" with commandline "PABg8" (UID: 00000000-00002960), Spawned process "readelf.exe" (UID: 00000000-00003320), Spawned process "readelf.exe" (UID: 00000000-00004776), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00001152), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00005196), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00002044), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007036), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005520), Spawned process "msedge.exe" with commandline "--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu ..." (UID: 00000000-00006748), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005552), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00003900), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=on_device_model.mojom.OnDevice ..." (UID: 00000000-00003624), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00006952), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005932), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00006312), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00006428)45:Tcac,Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00003588), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00006884), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004172), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00006216), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00004248), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00004216), Spawned process "_.exe" (UID: 00000000-00005572), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00007916), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00006856), Spawned process "readelf.exe" with commandline "PABg8" (UID: 00000000-00002960), Spawned process "readelf.exe" (UID: 00000000-00003320), Spawned process "readelf.exe" (UID: 00000000-00004776), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00001152), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00005196), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00002044), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007036), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005520), Spawned process "msedge.exe" with commandline "--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu ..." (UID: 00000000-00006748), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005552), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00003900), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=on_device_model.mojom.OnDevice ..." (UID: 00000000-00003624), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00006952), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005932), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00006312), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00006428)46:T1385,The input sample is signed with a certificate issued by "CN=Microsoft Azure ECC TLS Issuing CA 08, O=Microsoft Corporation, C=US" (SHA1: C4:43:52:F9:92:85:7E:04:DC:12:13:66:2A:79:A8:B6:F2:16:91:AE; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 71:6D:F8:46:38:AC:8E:6E:EB:E6:44:16:C8:DD:38:C2:A2:5F:66:30; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft Azure RSA TLS Issuing CA 07, O=Microsoft Corporation, C=US" (SHA1: 4D:9D:08:A3:C6:26:54:F1:81:FA:C7:F4:59:59:57:69:7E:8E:C5:96; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 33:82:51:70:58:A0:C2:02:28:D5:98:EE:75:01:B6:12:56:A7:64:42; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=GeoTrust TLS ECC CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: C6:A7:9F:4F:A3:32:C1:3F:51:DB:C6:1F:5D:2B:37:2F:71:ED:6B:69; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: BF:E7:BA:21:A2:FA:56:71:9B:61:F6:4E:E1:B2:69:D0:B8:0B:44:E5; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 9B:11:B0:70:AE:60:F2:0E:B2:4D:34:65:C9:F8:5D:33:2F:37:89:2F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 04, O=Microsoft Corporation, C=US" (SHA1: 08:63:6F:87:96:38:B7:D5:CF:DA:6B:80:0A:72:98:FB:63:01:E7:77; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: DA:6D:04:00:64:1B:45:AE:CC:59:5D:24:E5:03:7A:A6:BC:09:C3:58; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 48:62:BA:29:DB:48:52:50:EC:DE:95:62:15:70:58:A6:E2:13:BC:AE; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 7B:40:95:9C:A6:F3:08:E5:89:4E:40:4C:00:30:B1:DF:B8:63:30:45; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign RSA OV SSL CA 2018, O=GlobalSign nv-sa, C=BE" (SHA1: 21:BF:66:0D:67:BE:7A:7F:49:48:05:30:F4:7F:09:F2:30:36:CA:63; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3" (SHA1: DF:E8:30:23:06:2B:99:76:82:70:8B:4E:AB:8E:81:9A:FF:5D:97:75; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 0B:BF:AB:97:05:95:95:E8:D1:EC:48:E8:9E:B8:65:7C:0E:5A:AE:71; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 1A:63:7B:F3:04:6F:4C:E4:F3:15:87:E8:E7:FA:DD:B1:F7:7E:89:49; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information)47:T2cab,"JhwRME7kax.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 (stripped to external PDB) 3 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\JhwRME7kax.dll]- [targetUID: 00000000-00003320] "readelf.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 (stripped to external PDB) 11 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\readelf.exe]- [targetUID: 00000000-00003320] "msvcp140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\msvcp140.dll]- [targetUID: 00000000-00005572] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\vcruntime140.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-private-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-private-l1-1-0.dll]- [targetUID: 00000000-00005572] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\vcruntime140_1.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-winrt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-winrt-string-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-multibyte-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-multibyte-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-winrt-error-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-winrt-error-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-winrt-error-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-winrt-error-l1-1-1.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-xstate-l2-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-xstate-l2-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-xstate-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-xstate-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-synch-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-sysinfo-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-libraryloader-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-conio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-conio-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-processenvironment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-processenvironment-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-heap-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-console-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-console-l1-2-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-processthreads-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-processthreads-l1-1-1.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-console-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-console-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-rtlsupport-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-rtlsupport-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-memory-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-memory-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-timezone-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-timezone-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-file-l2-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-file-l2-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-datetime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-datetime-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-handle-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-handle-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-file-l1-2-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-namedpipe-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-namedpipe-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-debug-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-debug-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-errorhandling-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-errorhandling-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-string-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-interlocked-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-interlocked-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-util-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-util-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-profile-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-profile-l1-1-0.dll]- [targetUID: 00000000-00005572] "is-2779946581.tmp" has type "7-zip archive data version 0.3"- Location: [%TEMP%\is-2779946581.tmp]- [targetUID: 00000000-00005572] ".crash" has type "7-zip archive data version 0.3"- Location: [%ALLUSERSPROFILE%\TO8zU\.crash]- [targetUID: 00000000-00003320] "abff69ec-0531-de64-d731-20f5c46bbe12.tmp" has type "data"- Location: [%TEMP%\abff69ec-0531-de64-d731-20f5c46bbe12.tmp]- [targetUID: 00000000-00003320] "dc8780bb-4357-9b61-f72c-316153e4a081.tmp" has type "data"- Location: [%ALLUSERSPROFILE%\dc8780bb-4357-9b61-f72c-316153e4a081.tmp]- [targetUID: 00000000-00005572]48:T5a0,"_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "")49:T1490,"JhwRME7kax.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 (stripped to external PDB) 3 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\JhwRME7kax.dll]- [targetUID: 00000000-00003320] "msvcp140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\msvcp140.dll]- [targetUID: 00000000-00005572] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\vcruntime140.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-private-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-private-l1-1-0.dll]- [targetUID: 00000000-00005572] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\vcruntime140_1.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-winrt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-winrt-string-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-multibyte-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-multibyte-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-winrt-error-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-winrt-error-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-winrt-error-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-winrt-error-l1-1-1.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-xstate-l2-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-xstate-l2-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-xstate-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-xstate-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-synch-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-sysinfo-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-libraryloader-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00005572]4a:T954,"_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")4b:T453,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002960-00000C2C-1337929123") Found reference to API "dpanicDPANICabortedCopySidWSARecvWSASendconnectsignal unknownDesktop%.2f GB%.2f MB%.2f KBCmdList(error)readdirchtimesconsolesymlinkforcegcallocmWcpuprofallocmRgctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events, goid= mark s=nil" (Indicator: "WSARecv"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found reference to API "dpanicDPANICabortedCopySidWSARecvWSASendconnectsignal unknownDesktop%.2f GB%.2f MB%.2f KBCmdList(error)readdirchtimesconsolesymlinkforcegcallocmWcpuprofallocmRgctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events, goid= mark s=nil" (Indicator: "WSASend"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "WSASend"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "WSAStartup"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp")4c:T87f,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00002960-00000C2C-1337929123") file/memory contains long string with (Indicator: " accept "; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") file/memory contains long string with (Indicator: " connect "; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") file/memory contains long string with (Indicator: " shutdown "; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") file/memory contains long string with (Indicator: " socket "; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "Num: Value Size Type Bind Vis+Other Ndx(SecName) Name [+ Version Info]" (Indicator: " bind "; Source: "00000000-00003320.00000002.154236.97A96000.00000002.mdmp") Found reference to API "Num: Value Size Type Bind Vis Ndx Name" (Indicator: " bind "; Source: "00000000-00003320.00000002.154236.97A96000.00000002.mdmp") Found reference to API "Num: Value Size Type Bind Vis+Other Ndx(SecName) Name [+ Version Info]" (Indicator: " bind "; Source: "00000000-00003320.00000002.154236.97A96000.00000002.mdmp") Found reference to API "Num: Value Size Type Bind Vis Ndx Name" (Indicator: " bind "; Source: "00000000-00003320.00000002.154236.97A96000.00000002.mdmp") file/memory contains long string with (Indicator: "wsastartup"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "wsacleanup"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "gethostbyname"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: " accept "; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp")4d:T1a26,Heuristic match: "*http2.tf" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0]i8k|wlvm5'ezdzmhymxyawashington1redmond1microsoft" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0[n\q5a}-" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_2010-07-06.crl0zn0l0j" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0h" Heuristic match: "ner.co" Heuristic match: "macomer.co" Pattern match: "www.baidu.com" Pattern match: "www.baidu.comuser-agent" Heuristic match: "trc.taboola.com" Heuristic match: "px.ads.linkedin.com" Heuristic match: "m.adnxs.com" Heuristic match: "edgeassetservice.azureedge.net" Pattern match: "www.googleapis.com" Heuristic match: "edge-consumer-static.azureedge.net" Heuristic match: "ib.adnxs.com" Heuristic match: "r.msftstatic.com" Heuristic match: "sb.scorecardresearch.com" Pattern match: "row.scanclients2.google.com/service/update2/crxcorruption" Pattern match: "runtimesource.seed/appdata/local/chromium/user" Pattern match: "wedge.microsoft.com/extensionwebstorebase/v1/crxselect" Pattern match: "microsoftedge.microsoft.com/addons/detail/chacha20" Pattern match: "https://go.dev/issue/66821" Pattern match: "golang.org/s/cgihttpproxythe" Pattern match: "github.com/redteampentesting/kbtls" Pattern match: "github.com/userexistserror/conpty" Pattern match: "github.com/andybalholm/brotli" Pattern match: "github.com/armon/go-socks5" Pattern match: "github.com/atotto/clipboard" Pattern match: "github.com/axgle/mahonia" Pattern match: "github.com/bodgit/plumbing" Pattern match: "github.com/bodgit/sevenzip" Pattern match: "github.com/bodgit/windows" Pattern match: "github.com/cenkalti/backoff/v4" Pattern match: "github.com/cespare/xxhash/v2" Pattern match: "github.com/chocolatkey/chacha8" Pattern match: "github.com/clipperhouse/stringish" Pattern match: "github.com/clipperhouse/uax29/v2" Pattern match: "github.com/coder/websocket" Pattern match: "github.com/dustin/go-humanize" Pattern match: "github.com/go-faster/errors" Pattern match: "github.com/go-faster/jx" Pattern match: "github.com/go-faster/xor" Pattern match: "github.com/go-ole/go-ole" Pattern match: "github.com/gocarina/gocsv" Pattern match: "github.com/golang/snappy" Pattern match: "github.com/google/uuid" Pattern match: "github.com/gotd/ige" Pattern match: "github.com/gotd/neo" Pattern match: "github.com/gotd/td" Pattern match: "github.com/hashicorp/golang-lru/v2" Pattern match: "github.com/hashicorp/yamux" Pattern match: "github.com/iyear/connectproxy" Pattern match: "github.com/iyear/tdl/core" Pattern match: "github.com/karlmcguire/ige" Pattern match: "github.com/kbinani/screenshot" Pattern match: "github.com/klauspost/compress" Pattern match: "github.com/lxn/win" Pattern match: "github.com/mattn/go-isatty" Pattern match: "github.com/mattn/go-runewidth" Pattern match: "github.com/moond4rk/hackbrowserdata" Pattern match: "github.com/ncruces/go-strftime" Pattern match: "github.com/olekukonko/tablewriter" Pattern match: "github.com/otiai10/copy" Pattern match: "github.com/otiai10/mint" Pattern match: "github.com/parsiya/golnk" Pattern match: "github.com/pierrec/lz4/v4" Pattern match: "github.com/remyoudompheng/bigfft" Pattern match: "github.com/segmentio/asm" Pattern match: "github.com/shirou/gopsutil" Pattern match: "github.com/shirou/gopsutil/v4" Pattern match: "github.com/spf13/afero" Pattern match: "github.com/syndtr/goleveldb" Pattern match: "github.com/tidwall/gjson" Pattern match: "github.com/tidwall/match" Pattern match: "github.com/tidwall/pretty" Pattern match: "github.com/ulikunitz/xz" Pattern match: "github.com/vmihailenco/msgpack/v5" Pattern match: "github.com/vmihailenco/tagparser/v2" Pattern match: "github.com/yusufpapurcu/wmi" Pattern match: "go.opentelemetry.io/otel" Pattern match: "go.opentelemetry.io/otel/trace" Pattern match: "go.uber.org/atomic" Pattern match: "go.uber.org/multierr" Pattern match: "go.uber.org/zap" Pattern match: "golang.org/x/crypto" Pattern match: "golang.org/x/exp" Pattern match: "golang.org/x/net" Pattern match: "golang.org/x/sync" Pattern match: "golang.org/x/sys" Pattern match: "golang.org/x/text" Pattern match: "modernc.org/libc" Pattern match: "modernc.org/mathutil" Pattern match: "modernc.org/memory" Pattern match: "modernc.org/sqlite" Pattern match: "rsc.io/qr" Heuristic match: "jaa.na" Pattern match: "birthpopuptypesapplyimagebeinguppernoteseveryshowsmeansextramatchtrackknownearlybegansuperpapernorthlearngivennamedendedtermspartsgroupbrandusingwomanfalsereadyaudiotakeswhile.com/livedcasesdailychildgreatjudgethoseunitsneverbroadcoastcoverapplefilescycles" Pattern match: "tos.org/ladvisedpenaltysimple:if" Pattern match: "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" Pattern match: "http://mathematicsmargin-top:eventually" Pattern match: "http://descriptionrelatively" Pattern match: "http://applicationslink" Pattern match: "www.googleorganizationautocompleterequirementsconservative" Pattern match: "http://navigation" Pattern match: "http://px" Pattern match: "www.world" Pattern match: "http://www.years" Pattern match: "http://interested" Pattern match: "http://familiar" Pattern match: "https://was" Pattern match: "https://ain" Pattern match: "http://whether" Pattern match: "http://interpreted" Pattern match: "http://addeventlistenerresponsible" Pattern match: "http://.jpg|right|thumb|.js" Pattern match: "http://according" Pattern match: "http://www.interpretation" Pattern match: "http://s;text-align:centerfont-weight" Pattern match: "http://style=float:left;concerned" Pattern match: "w3.org/1999/xhtml" Pattern match: "http://www.wencodeuricomponent" Pattern match: "http://encoding=utf-8" Pattern match: "http://www.icon" Pattern match: "http://imenglish" Pattern match: "http://www" Pattern match: "http://www.hortcut" Pattern match: "http://iparticipation" Pattern match: "http://xt/css" Pattern match: "http://www.text-decoration:underthe" Pattern match: "http://option" Pattern match: "http://.css" Pattern match: "http://www.css" Pattern match: "http://ator" Pattern match: "http://www-//w3c//dtd" Pattern match: "http://www.c//dtd" Pattern match: "aea6a2a.afa/aoa" Heuristic match: "lg.hk" Pattern match: "https://sourceware.org/bugzilla/" Heuristic match: "ar.lc" Pattern match: "github.com/bodgit/sevenzip/internal/aes7z.password"4e:T7468,Found URL "https://chrome.google.com/webstore/detail/poly1305:" - Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found URL "https://microsoftedge.microsoft.com/addons/detail/chacha20:" - Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found URL "https://go.dev/issue/66821):" - Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found URL "https://go.dev/pkg/crypto/rsa" - Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found URL "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "http://mathematicsmargin-top:eventually" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "http://descriptionrelatively" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "http://applicationslink" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "http://navigation" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "http://px;" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "https://www.world" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "http://www.years" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "http://interested" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "http://familiar" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "https://was" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "https://ain" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "http://whether" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "http://interpreted" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "http://);" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "http://addeventlistenerresponsible" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "http://.jpg" - Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp") Found URL "http://" - Source: "00000000-00003320.00000002.154236.97A96000.00000002.mdmp") Found URL "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "http://mathematicsmargin-top:eventually" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "http://descriptionrelatively" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "http://applicationslink" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "http://navigation" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "http://px;" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "https://www.world" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "http://www.years" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "http://interested" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "http://familiar" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "https://was" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "https://ain" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "http://whether" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "http://interpreted" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "http://);" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "http://addeventlistenerresponsible" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "http://.jpg" - Source: "00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found URL "http://9iqmgvw,czcthawte," - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0c" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3p^" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l*'a_*'a_*'a_*'a_*'a_*'a_+'a_+'a_++'a_?+'a_s+'a_g+'a_" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005572.00000000.149596.411F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0c" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c30^" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l*'a_*'a_*'a_*'a_*'a_*'a_+'a_+'a_++'a_?+'a_s+'a_g+'a_" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005572.00000001.151116.411F0000.00000004.mdmp")4f:T109e,GET / HTTP/1.1 Host: www.baidu.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67" Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rY Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image , GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp) Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2 Host: edgeassetservice.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /mouse-gesture/config.json HTTP/2 Host: edge-consumer-static.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty 50:Tc4e,Contains base62 string in header "222166F75FD3671F181970045E3D66DC;" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "253D222166F75FD3671F181970045E3D6" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rYPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "3D222166F75FD3671F181970045E3D66D" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image"51:T48a,Found HTTPS GET request to https://www.baidu.com/ Found HTTPS GET request to https://trc.taboola.com/sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= Found HTTPS GET request to https://px.ads.linkedin.com/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= Found HTTPS GET request to https://m.adnxs.com/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D Found HTTPS GET request to https://m.adnxs.com/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D Found HTTPS GET request to https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService Found HTTPS POST request to https://www.googleapis.com/chromewebstore/v1.1/items/verify Found HTTPS GET request to https://edge-consumer-static.azureedge.net/mouse-gesture/config.json52:T11d1,Found string "aesKey" (Indicator: "aes"; File: ".exe") Found string "chacha8" (Indicator: "chacha"; File: ".exe") file/memory contains long string with (Indicator: "chacha"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") file/memory contains long string with (Indicator: "ecdsa"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found string "%v%s exiting (persistent error %q)%s exiting (corruption detected)table@compaction range L%d %q:%qchacha20: invalid buffer overlapOTEL_EVENT_ATTRIBUTE_COUNT_LIMITlanguage: tag is not well-formed---" (Indicator: "chacha"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") file/memory contains long string with (Indicator: "aes128"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found string "dep github.com/chocolatkey/chacha8 v0.0.0-20200308092524-06a0ce7f6716 h1:NSjnwJb5rlX8weAJPotMIFtWSFt4Tjtkjt7nTBil1dA=" (Indicator: "chacha"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "jovendichaestantalessalirsuelopesosfinesllamabusco" (Indicator: "aes"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "cuandoenviarmadridbuscariniciotiempoporquecuentaestadopuedenjuegoscontraest" (Indicator: "aes"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "alatinafuerzaestiloguerraentrar" (Indicator: "aes"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "deutscheuropeueuskaragaeilgesvenskaespa" (Indicator: "aes"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "digoportadaespaciofamiliaantoniopermiteguardaralgunaspreciosalguiensentidovisitast" (Indicator: "aes"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "ltimaestamosoficialtambienning" (Indicator: "aes"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "ncompletaestudiosp" (Indicator: "aes"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "aescribirmedicinalicenciaconsultaaspectoscr" (Indicator: "aes"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "aespecialesdisponibleactualidadreferenciavalladolidbibliotecarelacionescalendariopol" (Indicator: "aes"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "%sfjaes" (Indicator: "aes"; Source: "00000000-00003320.00000002.154236.97A96000.00000002.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found string "../HanLaoMroNkoVaiGet..\\\.\\?\??adxaesshaavxfmaintmapnetexpMD4MD5ADXpngl10mac273277278280284285297420437838850851852855857860861862863865866868869871875916922'"'newACK200404://0" (Indicator: "aes"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp"), Found string "m= sp= sp: lr: fp= gp= mp=) m=portJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT as hour in eEpP.tmpHomeLeftDownCtrl.txt[%s]ReadFilePOSTicmpigmpftpshttppop3smtpdial" (Indicator: "aes"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp"), file/memory contains long string with (Indicator: "ecdsa"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp"), file/memory contains long string with (Indicator: "3des"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp"), file/memory contains long string with (Indicator: "base64"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp"), file/memory contains long string with (Indicator: "aes128"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp")53:Ta09,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002960.00000001.150097.97AEB000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003320.00000001.152314.97AEB000.00000004.mdmp") file/memory contains long string with (Indicator: "Thread32Next"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "Module32First"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "EnumProcessModules"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "GetModuleHandle"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp")54:T7cf,file/memory contains long string with (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002960.00000001.150097.25780000.00000004.mdmp") file/memory contains long string with (Indicator: "GetTempPath"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "GetFileAttributes"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "GetSystemDirectory"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "GetFileVersionInfo"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "GetCurrentDirectory"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004776.00000001.152674.CC238000.00000004.mdmp")55:T5a6,Found string "secret" (Indicator: "secret"; File: ".exe") Found string "Nsecret" (Indicator: "secret"; File: ".exe") Found string "password" (Indicator: "password"; File: ".exe") Found string "secretary" (Indicator: "secret"; File: "screen_1.png") file/memory contains long string with (Indicator: "secret"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") Found string "stratesecretar" (Indicator: "secret"; Source: "00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "secret"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "secret"; Source: "00000000-00004776.00000001.152674.CB652000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00004776.00000001.152674.CB652000.00000004.mdmp") Found string "stratesecretar" (Indicator: "secret"; Source: "00000000-00004776.00000001.152674.CB652000.00000004.mdmp")56:T7dc,file/memory contains long string with (Indicator: "GetAce"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "AddAce"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") Found reference to API "dpanicDPANICabortedCopySidWSARecvWSASendconnectsignal unknownDesktop%.2f GB%.2f MB%.2f KBCmdList(error)readdirchtimesconsolesymlinkforcegcallocmWcpuprofallocmRgctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events, goid= mark s=nil" (Indicator: "CopySid"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "GetLengthSid"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "RevertToSelf"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "IsWellKnownSid"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "MakeAbsoluteSD"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "ImpersonateSelf"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "CreateWellKnownSid"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "GetSidSubAuthority"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp") file/memory contains long string with (Indicator: "SetTokenInformation"; Source: "00000000-00004776.00000000.150753.1CC00000.00000004.mdmp")57:T96c,"_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")58:T2a69,"JhwRME7kax.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 (stripped to external PDB) 3 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\JhwRME7kax.dll]- [targetUID: 00000000-00003320] "readelf.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 (stripped to external PDB) 11 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\readelf.exe]- [targetUID: 00000000-00003320] "msvcp140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\msvcp140.dll]- [targetUID: 00000000-00005572] "vcruntime140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\vcruntime140.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-private-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-private-l1-1-0.dll]- [targetUID: 00000000-00005572] "vcruntime140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\vcruntime140_1.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-winrt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-winrt-string-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-multibyte-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-multibyte-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-winrt-error-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-winrt-error-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-winrt-error-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-winrt-error-l1-1-1.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-xstate-l2-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-xstate-l2-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-xstate-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-xstate-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-convert-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-convert-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-file-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-file-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-processthreads-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-processthreads-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-synch-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-synch-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-sysinfo-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-sysinfo-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-libraryloader-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-libraryloader-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-process-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-process-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-conio-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-conio-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-processenvironment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-processenvironment-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-heap-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-heap-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-console-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-console-l1-2-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-processthreads-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-processthreads-l1-1-1.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-console-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-console-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-rtlsupport-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-rtlsupport-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-synch-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-synch-l1-2-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-memory-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-memory-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-timezone-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-timezone-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-file-l2-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-file-l2-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-datetime-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-datetime-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-handle-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-handle-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-file-l1-2-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-file-l1-2-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-namedpipe-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-namedpipe-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-debug-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-debug-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-errorhandling-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-errorhandling-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-string-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-string-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-interlocked-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-interlocked-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-util-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-util-l1-1-0.dll]- [targetUID: 00000000-00005572] "api-ms-win-core-profile-l1-1-0.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-profile-l1-1-0.dll]- [targetUID: 00000000-00005572]59:T4d2d,"_.exe" wrote 12240 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-console-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 12256 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-console-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 11736 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-datetime-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 11728 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-debug-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 11728 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-errorhandling-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 15328 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-file-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 11728 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-file-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 11744 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-file-l2-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 11736 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-handle-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 12256 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-heap-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 11728 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-interlocked-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 12752 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-libraryloader-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 14800 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-localization-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 12240 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-memory-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 11728 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-namedpipe-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 12752 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-processenvironment-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 14288 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-processthreads-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 12240 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-processthreads-l1-1-1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 11728 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-profile-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 12240 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-rtlsupport-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 11728 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-string-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 13776 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-synch-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 12240 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-synch-l1-2-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 12768 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-sysinfo-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 12240 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-timezone-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 11728 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-util-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 19720 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-winrt-error-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 19216 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-winrt-error-l1-1-1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 20240 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-winrt-string-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 19192 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-xstate-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 19192 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-core-xstate-l2-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 12752 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-crt-conio-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 15824 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-crt-convert-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 12240 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-crt-environment-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 13776 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-crt-filesystem-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 12752 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-crt-heap-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 12240 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-crt-locale-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 20944 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-crt-math-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 19920 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-crt-multibyte-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 32768 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-crt-private-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 12752 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-crt-process-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 16336 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-crt-runtime-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 17872 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-crt-stdio-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 18384 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-crt-string-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 14288 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-crt-time-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 12240 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\api-ms-win-crt-utility-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 32768 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\JhwRME7kax.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 32768 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\msvcp140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 32768 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\vcruntime140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 32768 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\vcruntime140_1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "_.exe" wrote 32768 bytes starting with PE header signature to file "C:\ProgramData\TO8zU\readelf.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...5a:Ta80,"_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "_.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "_.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")5b:T1d62,File type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 (stripped to external PDB) 3 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\JhwRME7kax.dll" File type "PE32+ executable for MS Windows 5.02 (console) x86-64 (stripped to external PDB) 11 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\readelf.exe" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\msvcp140.dll" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\vcruntime140.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-private-l1-1-0.dll" File type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\vcruntime140_1.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-math-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-winrt-string-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-multibyte-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-winrt-error-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 3 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-winrt-error-l1-1-1.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-xstate-l2-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-xstate-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-string-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-stdio-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-runtime-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-convert-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-file-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-localization-l1-2-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-processthreads-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-time-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-filesystem-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-synch-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-sysinfo-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-libraryloader-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-process-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-conio-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-heap-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-processenvironment-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-heap-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-console-l1-2-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-utility-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-locale-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-processthreads-l1-1-1.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-console-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-crt-environment-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-rtlsupport-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-synch-l1-2-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-memory-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-timezone-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-file-l2-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-datetime-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-handle-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-file-l1-2-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-namedpipe-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-debug-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-errorhandling-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-string-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-interlocked-l1-1-0.dll" File type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections" was dropped at "%ALLUSERSPROFILE%\TO8zU\api-ms-win-core-util-l1-1-0.dll"5c:T406,GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbPl1N!y*v_#NUa*CcSjN55W'8QkQrTNH>rY Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"346f5ff1750f46f19d671e47f5a40439ed90a3a19a6d0ef6f5e18de8d02f1d78","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1791826197181,"unified_at":"2026-10-12T17:29:57.181Z","metadata":{"hashes":{"sha256":"346f5ff1750f46f19d671e47f5a40439ed90a3a19a6d0ef6f5e18de8d02f1d78","sha1":"0a3918750cfc50272953d53813963256f5ebd61e","md5":"5be24ed89c43ff0cbaafec4eea31d219","sha512":"9c2a01c3e21d69386726dd42c7012fa8b9b98492fe8c2e0586ef3f2ec101bc67b0c8b5cd25b4aa7a92209dae19dc49e16caae3e3f580ca684023d4dc5e1b1995","ssdeep":"196608:kPAVbQ6QH35kTwRzpzLpGxW+LIuvHa3zYqvD188:kOEWo1aKjYqr188","ssdeep_chunks":["196608:kPAVbQ6","196608:PAVbQ6Q","196608:AVbQ6QH","196608:VbQ6QH3","196608:bQ6QH35","196608:Q6QH35k","196608:6QH35kT","196608:QH35kTw","196608:H35kTwR","196608:35kTwRz","196608:5kTwRzp","196608:kTwRzpz","196608:TwRzpzL","196608:wRzpzLp","196608:RzpzLpG","196608:zpzLpGx","196608:pzLpGxW","196608:zLpGxW+","196608:LpGxW+L","196608:pGxW+LI","196608:GxW+LIu","196608:xW+LIuv","196608:W+LIuvH","196608:+LIuvHa","196608:LIuvHa3","196608:IuvHa3z","196608:uvHa3zY","196608:vHa3zYq","196608:Ha3zYqv","196608:a3zYqvD","196608:3zYqvD1","196608:zYqvD18","196608:YqvD188","393216:kPAVbQ6","393216:PAVbQ6Q","393216:AVbQ6QH","393216:VbQ6QH3","393216:bQ6QH35","393216:Q6QH35k","393216:6QH35kT","393216:QH35kTw","393216:H35kTwR","393216:35kTwRz","393216:5kTwRzp","393216:kTwRzpz","393216:TwRzpzL","393216:wRzpzLp","393216:RzpzLpG","393216:zpzLpGx","393216:pzLpGxW","393216:zLpGxW+","393216:LpGxW+L","393216:pGxW+LI","393216:GxW+LIu","393216:xW+LIuv","393216:W+LIuvH","393216:+LIuvHa","393216:LIuvHa3","393216:IuvHa3z","393216:uvHa3zY","393216:vHa3zYq","393216:Ha3zYqv","393216:a3zYqvD","393216:3zYqvD1","393216:zYqvD18","393216:YqvD188","196608:kOEWo1a","196608:OEWo1aK","196608:EWo1aKj","196608:Wo1aKjY","196608:o1aKjYq","196608:1aKjYqr","196608:aKjYqr1","196608:KjYqr18","196608:jYqr188"],"imphash":"Unknown"},"file_info":{"file_name":"点击此处安装汉化语言包.exe","file_type":["compressed","64bits","innosetup"],"file_type_id":"64-bit innosetup","file_size":15789568,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1776958181000,"last_seen":1776960900000,"last_multi_scan":1776960900000}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":["evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":94},"sandbox_signatures":{"informative_count":201,"suspicious_count":12,"malicious_count":3,"total":216},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"References task scheduler-related strings"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to block user input (API string)"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Credential Access","technique":"Securityd Memory","attack_id":"T1555.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/002","identifiers":[{"type":"informative","value":"Able to retrieve credentials from memory"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Contains ability retrieve IPv4 mapping information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Able to monitor clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"},{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"file/memory contains long string with (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"file/memory contains long string with (Indicator: \"OpenThread\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"ResumeThread\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00004776.00000001.152674.CC238000.00000004.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00004776.00000001.152674.CC238000.00000004.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004776.00000001.152674.CC238000.00000004.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00004776.00000001.152674.CC238000.00000004.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00004776.00000001.152674.CC238000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"file/memory contains long string with (Indicator: \"RtlCreateUserThread\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"file/memory contains long string with (Indicator: \"SetupDiEnumDeviceInfo\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"SetThreadToken\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"OpenThreadToken\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003320.00000002.154236.65EAC000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004776.00000001.152674.CC238000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004776.00000001.152674.CC238000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"file/memory contains long string with (Indicator: \"ControlService\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\#\\&\\)\\+\\\n\\.\\0\\2\\5\\6\\Y\\Z\\\\\\b\\c\\g\\h\\i\\; Source: \"00000000-00003320.00000001.152314.CB652000.00000004.mdmp, 00000000-00003320.00000002.154236.CB652000.00000004.mdmp\")\n Found string - \\#\\&\\)\\+\\\n\\.\\0\\2\\5\\6\\Y\\Z\\\\\\b\\c\\g\\h\\i\\; Source: \"00000000-00004776.00000001.152674.CB652000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \": BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"BlockInput\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00004776.00000000.150753.FBFD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$30","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002960-00000C2C-1338055228\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"api-ms-win-core-file-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002960-00000C2C-1338055228\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetSystemFirmwareTable\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"api-ms-win-core-processenvironment-l1-1-0.dll\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002960-00000C2C-1337893624\")\n file/memory contains long string with (Indicator: \"GetCursorPos\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"api-ms-win-core-processthreads-l1-1-0.dll\")\n file/memory contains long string with (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"file/memory contains long string with (Indicator: \"FreeSid\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"file/memory contains long string with (Indicator: \"moz_cookies\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"cookies.sqlite\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"/cookies\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getusergeoid\"; File: \"api-ms-win-core-localization-l1-2-0.dll\")\n file/memory contains long string with (Indicator: \"getgeoinfo\"; File: \"api-ms-win-core-localization-l1-2-0.dll\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00004776.00000001.152674.CC238000.00000004.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00004776.00000001.152674.CC238000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"file/memory contains long string with (Indicator: \".drivetype\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"readelf.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002960)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"readelf.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002960)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"readelf.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002960)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"readelf.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003320)\n \"readelf.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004776)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"readelf.exe\" called \"GetWindowTextA\" with parameter \"New tab - Profile 1 - Microsoft? Edge\" - (UID: 00000000-00003320)\n \"readelf.exe\" called \"GetWindowTextA\" with parameter \"New tab - Profile 1 - Microsoft? Edge\" - (UID: 00000000-00004776)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"readelf.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002960)\n \"readelf.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003320)\n \"readelf.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004776)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"file/memory contains long string with (Indicator: \"IsWow64Process\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"file/memory contains long string with (Indicator: \"FindNextVolume\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"FindVolumeClose\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetVolumePathName\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$32","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetSystemTime\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"_.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"_.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"readelf.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information set for devices (API string)","description":"file/memory contains long string with (Indicator: \"SetupDiEnumDeviceInfo\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1480","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetSystemTime\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"file/memory contains long string with (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"file/memory contains long string with (Indicator: \"tracert\"; File: \"api-ms-win-core-rtlsupport-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetVersion\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$35","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"readelf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"_.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"api-ms-win-core-file-l2-1-0.dll\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"api-ms-win-core-processenvironment-l1-1-0.dll\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$36","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.baidu.com\"\n \"trc.taboola.com\"\n \"px.ads.linkedin.com\"\n \"m.adnxs.com\"\n \"edgeassetservice.azureedge.net\"\n \"www.googleapis.com\"\n \"edge-consumer-static.azureedge.net\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"108.139.47.92:443\"\n \"151.101.129.44:443\"\n \"150.171.22.12:443\"\n \"104.254.148.251:443\"\n \"103.235.46.115:443\"\n \"142.251.41.170:443\"\n \"150.171.29.11:443\"\n \"150.171.109.177:443\"\n \"52.123.248.69:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$39","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"file/memory contains long string with (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"file/memory contains long string with (Indicator: \"LoadResource\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"LockResource\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"SizeofResource\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp, 00000000-00002960.00000001.150097.97AEB000.00000004.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003320.00000001.152314.97AEB000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetLastError\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004776.00000001.152674.CC238000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"file/memory contains long string with (Indicator: \"GetShellWindow\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"internal error: exactly one of res or err should be set; nil=%vcrypto/ecdh: use of X25519 is not allowed in FIPS 140-only modetls: unexpected encrypted client hello extension in serverHellocrypto/ecdh: internal error: public key is the identity elementcryptobyte: BuilderContinuation reallocated a fixed-size bufferleveldb/table: Writer: keys are not in increasing order: %q, %qSoftware\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Foldersruntime.SetFinalizer: first argument was allocated into an arenacompileCallback: expected function with one uintptr-sized resultattempted to trace stack of a goroutine this thread does not own0000000000000000000000000000000000000000000000000000000000000000\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tgo package net: GODEBUG setting forcing use of the cgo resolver\" in Source: 00000000-00002960.00000001.150097.25780000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$3d","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$3e","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"px.ads.linkedin.com\" (Indicator: \"linkedin.com\"; File: \"PCAP\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3f","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"_.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A8E70000\n \"_.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A78D0000\n \"readelf.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A8E70000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"_.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AB260000\n \"readelf.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AB260000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"$41","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7f9a7f87f0000@ntdll.dll\"\n \"220023000000000018c7f9a7f87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$42","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"readelf.exe\" touched \"TaskScheduler class\" (Path: \"HKCU\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$43","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"edge-consumer-static.azureedge.net\"\n \"edgeassetservice.azureedge.net\"\n \"ib.adnxs.com\"\n \"m.adnxs.com\"\n \"px.ads.linkedin.com\"\n \"r.msftstatic.com\"\n \"sb.scorecardresearch.com\"\n \"trc.taboola.com\"\n \"www.baidu.com\"\n \"www.googleapis.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"readelf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"readelf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$44","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$45","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$46","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"_.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-2779946581.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"file/memory contains long string with (Indicator: \"CreateService\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003320.00000002.154236.65EAC000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004776.00000001.152674.CC238000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004776.00000001.152674.CC238000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"readelf.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$47","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"is-2779946581.tmp\" has type \"7-zip archive data version 0.3\" - Location: [%TEMP%\\is-2779946581.tmp]\n \"abff69ec-0531-de64-d731-20f5c46bbe12.tmp\" has type \"data\" - Location: [%TEMP%\\abff69ec-0531-de64-d731-20f5c46bbe12.tmp]\n \"dc8780bb-4357-9b61-f72c-316153e4a081.tmp\" has type \"data\" - Location: [%ALLUSERSPROFILE%\\dc8780bb-4357-9b61-f72c-316153e4a081.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$49","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"readelf.exe\" queries basic process information of the \"C:\\ProgramData\\TO8zU\\readelf.exe\" (UID: 2960)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"_.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-2779946581.tmp\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Installation/Persistence","name":"References task scheduler-related strings","description":"Found reference to API \"chedule.Service.1(\"GetFolder\")(\"RegisterTaskDefinition\")\" (Indicator: \"RegisterTask\"; Source: \"00000000-00002960.00000001.150097.1A900000.00000004.mdmp\")\n Found reference to API \"chedule.Service.1(\"GetFolder\")(\"RegisterTaskDefinition\")\" (Indicator: \"RegisterTaskDefinition\"; Source: \"00000000-00002960.00000001.150097.1A900000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":1,"id":"string-401","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect presence of virtual environment (API string)\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"_.exe\" trying to touch file \"C:\\Windows\\System32\\winmm.dll\"\n \"_.exe\" trying to touch file \"C:\\Windows\\System32\\winmmbase.dll\"\n \"_.exe\" trying to touch file \"C:\\Windows\\System32\\mswsock.dll\"\n \"_.exe\" trying to touch file \"C:\\Windows\\System32\\wshqos.dll\"\n \"_.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"_.exe\" trying to access non-existent file \"C:\\BCRYPT.DLL\"\n \"_.exe\" trying to access non-existent file \"C:\\CRYPTBASE.DLL\"\n \"readelf.exe\" trying to access non-existent file \"C:\\ProgramData\\TO8zU\\FLTLIB.DLL\"\n \"readelf.exe\" trying to access non-existent file \"C:\\ProgramData\\TO8zU\\CRYPTSP.DLL\"\n \"readelf.exe\" trying to access non-existent file \"C:\\ProgramData\\TO8zU\\SSPICLI.DLL\"\n \"readelf.exe\" trying to access non-existent file \"C:\\ProgramData\\TO8zU\\SspiCli.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"_.exe\" trying to access non-existent file \"C:\\_.EXE.LOCAL\"\n \"_.exe\" trying to access non-existent file \"C:\\ProgramData\\TO8ZU\"\n \"readelf.exe\" trying to access non-existent file \"C:\\ProgramData\\1F3B3C16-62C6-DC33-F544-6392D8881639.TMP\"\n \"readelf.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}\"\n \"readelf.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}\"\n \"readelf.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\ABFF69EC-0531-DE64-D731-20F5C46BBE12.TMP\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"_.exe\" writes file \"c:\\programdata\\dc8780bb-4357-9b61-f72c-316153e4a081.tmp\"\n \"_.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-2779946581.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"api-ms-win-core-sysinfo-l1-1-0.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexa\"; File: \"api-ms-win-core-sysinfo-l1-1-0.dll\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00003320-00000C2C-1366671249\")\n file/memory contains long string with (Indicator: \"getcomputernameexw\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /\"\n Found http requests in header \"GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent=\"\n Found http requests in header \"GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent=\"\n Found http requests in header \"GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D\"\n Found http requests in header \"GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D\"\n Found http requests in header \"GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService\"\n Found http requests in header \"POST /chromewebstore/v1.1/items/verify\"\n Found http requests in header \"GET /mouse-gesture/config.json\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"dpanicDPANICabortedCopySidWSARecvWSASendconnectsignal unknownDesktop%.2f GB%.2f MB%.2f KBCmdList(error)readdirchtimesconsolesymlinkforcegcallocmWcpuprofallocmRgctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events, goid= mark s=nil\" (Indicator: \"WSARecv\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n Found reference to API \"dpanicDPANICabortedCopySidWSARecvWSASendconnectsignal unknownDesktop%.2f GB%.2f MB%.2f KBCmdList(error)readdirchtimesconsolesymlinkforcegcallocmWcpuprofallocmRgctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events, goid= mark s=nil\" (Indicator: \"WSASend\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"WSASend\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"WSAStartup\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"www.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"92.168.0.1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.0H9\" (Indicator: \"HTTP/1.0\"; File: \".exe\")\n Found string \"HTTP/1.1H9\" (Indicator: \"HTTP/1.1\"; File: \".exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$4f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"`8EAyN{@\"\n \"'++)\"\n \"m{PE}M8M\"\n \"ii&i^}\"\n \"img(z{bw(umz^=Qu_{N9p0vi'\"\n \"img(z{b\"\n \"m{PE}M8M\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$50","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"px.ads.linkedin.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 88022c2235c29a182feb4fa4a84b842a\n Observed JA3 fingerprint: 8cfb3a12fa1845a0658a4196a5e172b5\n Observed JA3 fingerprint: 23c9913ed159cbe60e7eb884f6ca7bd8\n Observed JA3 fingerprint: 1ca63e2c9395dff0360a0d76dec37a67\n Observed JA3 fingerprint: b525a73277dc5a30fbd8ca450bfba8b9\n Observed JA3 fingerprint: a43497e21e27928ec185738a06c3e169\n Observed JA3 fingerprint: da9649fa8f2fc6e3e9d80ca22596c18f\n Observed JA3 fingerprint: bd2c4dcb6e3f80e780b5f9644891d508\n Observed JA3 fingerprint: 37c53496b8ecd6206d4fac62c05528f9\n Observed JA3 fingerprint: 62f15e454fea9232315c75547b0e90bd\n Observed JA3 fingerprint: c79602e1529e46c97f4832c191641b6d\n Observed JA3 fingerprint: f0672ba3a422d92b02aeb729285b62d4\n Observed JA3 fingerprint: cd6863842b6b2ce8d430632558f3923a\n Observed JA3 fingerprint: 1fec41a383221c966f3ccdd4c3cda973\n Observed JA3 fingerprint: 6b31d0f02b2409e93be1765df634c36b\n Observed JA3 fingerprint: 6a041caf3df3086e4b7e6ee0cddf472e\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"edgeassetservice.azureedge.net\" (2 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$51","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"www.googleapis.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"108.139.47.92\" on port \"443\"\n HTTPS traffic to \"151.101.129.44\" on port \"443\"\n HTTPS traffic to \"150.171.22.12\" on port \"443\"\n HTTPS traffic to \"104.254.148.251\" on port \"443\"\n HTTPS traffic to \"103.235.46.115\" on port \"443\"\n HTTPS traffic to \"142.251.41.170\" on port \"443\"\n HTTPS traffic to \"150.171.29.11\" on port \"443\"\n HTTPS traffic to \"150.171.109.177\" on port \"443\"\n HTTPS traffic to \"52.123.248.69\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00004776\"\n YARA signature for AES encryption matched on process \"00000000-00003320\"\n YARA signature for AES encryption matched on file \"JhwRME7kax.dll\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"file/memory contains long string with (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--profile-directory=Default\" (Indicator: \"--profile-directory=\"; File: \"msedge.exe\")","origin":"File/Memory","mitre_attack_id":"T1550.004","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"00000000-00003320-00000C2C-1365838496\")\n file/memory contains long string(Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"[1mZzzzzzzz%s%d%.2f190119941996%03dLOCK.bakwarn\"Ok\"ntohsGetDC%s:%d%s|%stdatachdirwritemkdirchmodcloseLstatdefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptracepanicsleepamd64gcing MB, got= ...\" (Indicator: \"GetDC\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"BitBlt\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetDIBits\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; File: \"api-ms-win-core-file-l1-1-0.dll\")\n file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"file/memory contains long string(Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve credentials from memory","description":"Found string \"NT_PROCSTAT_VMMAP (vmmap data)\" (Indicator: \"vmmap \"; Source: \"00000000-00003320.00000002.154236.97A96000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.002","relevance":1,"id":"string-5073","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"82042010191,4332,103,,GetAsyncKeyState,user32.dll,\"00:39:40.046\",RX=0,PX=0\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00003320.00000002.154236.4D0D0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"MapVirtualKey\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"file/memory contains long string with (Indicator: \"GetUserName\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"LookupAccountName\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetTokenInformation\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"readelf.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"readelf.exe\" called \"GetComputerNameW\" (UID: 00000000-00002960)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"readelf.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"readelf.exe\" called \"GetUserNameW\" (UID: 00000000-00003320)\n \"readelf.exe\" called \"GetUserNameW\" (UID: 00000000-00004776)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$52","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability retrieve IPv4 mapping information (API string)","description":"file/memory contains long string with (Indicator: \"GetIpForwardTable\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-87","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"file/memory contains long string with (Indicator: \"FindFirstFile\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"file/memory contains long string with (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004776.00000001.152674.CC238000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003320.00000002.154236.65EAC000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004776.00000001.152674.CC238000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"WHERE rowid=?1\" (Indicator: \"where \"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found string \"WHERE _rowid_ > %lld\" (Indicator: \"where \"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found string \"WHERE (%s) > (%s)\" (Indicator: \"where \"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found string \"WHERE name=%Q\" (Indicator: \"where \"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"file/memory contains long string with (Indicator: \"QueryDosDevice\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"Dir\" (Indicator: \"dir\"; Source: \"00000000-00003320.00000002.154236.97A96000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"file/memory contains long string with (Indicator: \"GetProcessId\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"file/memory contains long string with (Indicator: \"GetComputerName\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetTickCount\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$55","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"\" (Indicator: \"\"; Source: \"00000000-00003320.00000002.154236.97A96000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Hostname\" (Indicator: \"hostname\"; File: \".exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"file/memory contains long string with (Indicator: \"antivirusproduct\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \" Win32_PhysicalMemory\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \" Win32_VideoController\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"file/memory contains long string with (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"readelf.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002960)\n \"readelf.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003320)\n \"readelf.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004776)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002960.00000000.149893.1A900000.00000004.mdmp, 00000000-00002960.00000001.150097.1A900000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003320.00000000.150394.4D0D0000.00000004.mdmp, 00000000-00003320.00000001.152314.4D0D0000.00000004.mdmp, 00000000-00003320.00000002.154236.4D0D0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004776.00000000.150753.FBFD0000.00000004.mdmp, 00000000-00004776.00000001.152674.FBFD0000.00000004.mdmp, 00000000-00004776.00000002.154594.FBFD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00002960.00000000.149893.1A900000.00000004.mdmp, 00000000-00002960.00000001.150097.1A900000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003320.00000000.150394.4D0D0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003320.00000001.152314.4D0D0000.00000004.mdmp, 00000000-00003320.00000002.154236.4D0D0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004776.00000000.150753.FBFD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"leveldb/memdb: iterator releasedleveldb/table: iterator releasedtableLog (%d) > maxTableLog (%d)too many levels of symbolic linksInitializeProcThreadAttributeList[!]Error calling OpenProcess:\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: .exe\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: .exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002960.00000001.150097.97AEB000.00000004.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003320.00000001.152314.97AEB000.00000004.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004776.00000001.152674.CC238000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004776.00000001.152674.CC238000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"_.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"_.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\PROGRAMDATA\\TO8ZU\\READELF.EXE\"; Value: \"554A83E974D3DC010000000000000000000000000200000000\")\n \"readelf.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\PARTMGR\"; Key: \"ENABLECOUNTERFORIOCTL\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"_.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\PROGRAMDATA\\TO8ZU\\READELF.EXE\"; Value: \"554A83E974D3DC010000000000000000000000000200000000\")\n \"_.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")\n \"readelf.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"OGVQY\"; Value: \"%ALLUSERSPROFILE%\\TO8zU\\readelf.exe\")\n \"readelf.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\PARTMGR\"; Key: \"ENABLECOUNTERFORIOCTL\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002960.00000001.150097.25780000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"CreateMutex\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004776.00000000.150753.1CC00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"abort\" (Source: .exe, API is part of module: UCRTBASE.DLL)\n Found string \"trunc\" (Source: .exe, API is part of module: UCRTBASE.DLL)\n Found string \"accept\" (Source: .exe, API is part of module: WS2_32.DLL)\n Found string \"signal\" (Source: .exe, API is part of module: UCRTBASE.DLL)\n Found string \"remove\" (Source: .exe, API is part of module: UCRTBASE.DLL)\n Found string \"connect\" (Source: .exe, API is part of module: WS2_32.DLL)\n Found string \"tmpfile\" (Source: .exe, API is part of module: UCRTBASE.DLL)\n Found string \"shutdown\" (Source: .exe, API is part of module: WS2_32.DLL)\n Found string \"WSAIoctl\" (Source: .exe, API is part of module: WS2_32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"readelf.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"OGVQY\"; Value: \"%ALLUSERSPROFILE%\\TO8zU\\readelf.exe\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\ProgramData\\TO8zU\\readelf.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"\"POST /chromewebstore/v1.1/items/verify HTTP/2\nHost: www.googleapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nContent-Type: application/json\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty\" with payload::==> \"{\"hash\":\"w44oNlIcbIEOawL/BFpchE26it3usQ++D511GSwZ6UI=\",\"ids\":[\"ghbmnnjooekpmoecnnnilnnbdlolhkhi\"],\"protocol_version\":1}\" HTTP/2 200 OK\nContent-Type: application/json; charset=UTF-8\nDate: Thu\n 23 Apr 2026 15:30:21 GMT\nServer: ESF\nX-Xss-Protection: 0\nX-Content-Type-Options: nosniff\nVary: Referer\nContent-Encoding: gzip\nX-Frame-Options: SAMEORIGIN\nAlt-Svc: h3=\":443\"; ma=2592000\nh3-29=\":443\"; ma=2592000 with response body ==>BINARY_CONTENT.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 52.123.248.69\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$58","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"readelf.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"OGVQY\"; Value: \"%ALLUSERSPROFILE%\\TO8zU\\readelf.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$59","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 103.235.46.115 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"_.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-2779946581.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"C:\\_.exe\" spawned likely due to injection\n Process \"%ALLUSERSPROFILE%\\TO8zU\\readelf.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"$5b","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"readelf.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at A3770000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"readelf.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00002960)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 10 domains and 10 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]}]},"activity":{"stats":{"process_count":28,"spawned_processes_count":28,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":160,"dropped_files_count":0,"extracted_files_count":52,"files_written_count":61,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":9,"dns_resolutions_count":10,"contacted_urls_count":8,"http_requests_count":8},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69ea3ae42626cb0f6c004f93","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"contacted_countries":["CHN","USA"],"submit_name":"点击此处安装汉化语言包.exe","analysis_start_time":"2026-04-23T15:29:43+00:00","indicators_count":{"informative":201,"suspicious":39,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"108.139.47.92","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"address":"151.101.129.44","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"address":"150.171.22.12","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"address":"104.254.148.251","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"address":"103.235.46.115","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"address":"142.251.41.170","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"address":"150.171.29.11","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"address":"150.171.109.177","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"address":"52.123.248.69","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]}],"dns_resolutions":[{"domain":"edge-consumer-static.azureedge.net","address":"150.171.109.177","ttl":1148,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"domain":"edgeassetservice.azureedge.net","address":"150.171.109.185","ttl":683,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Microsoft Corporation","registrar_name_servers":"prd2.azuredns-cloud.net","registrar_creation_date":"2014-01-22T08:14:52+00:00","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"domain":"ib.adnxs.com","address":"104.254.148.251","ttl":20182,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"domain":"m.adnxs.com","address":"104.254.148.251","ttl":20810,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"domain":"px.ads.linkedin.com","address":"150.171.22.12","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"domain":"r.msftstatic.com","address":"150.171.28.10","ttl":1813,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"domain":"sb.scorecardresearch.com","address":"108.139.47.92","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"domain":"trc.taboola.com","address":"151.101.129.44","ttl":520,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"domain":"www.baidu.com","address":"103.235.46.115","ttl":328,"country":"China","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"domain":"www.googleapis.com","address":"142.251.41.170","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]}],"http_requests":[{"host":"www.baidu.com","host_ip":"103.235.46.115:443","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: www.baidu.com\nUser-Agent: Go-http-client/1.1\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"host":"trc.taboola.com","host_ip":"151.101.129.44:443","url":"/sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent=","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2\nHost: trc.taboola.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"host":"px.ads.linkedin.com","host_ip":"150.171.22.12:443","url":"/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent=","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2\nHost: px.ads.linkedin.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: bcookie=\"v=2&1391f723-91e0-4064-8cb8-08df8de6ce67\"\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"host":"m.adnxs.com","host_ip":"104.254.148.251:443","url":"/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D","method":"GET","response_code":"302","response_phrase":"Found","header":"$5c","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"host":"m.adnxs.com","host_ip":"104.254.148.251:443","url":"/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2\nHost: m.adnxs.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: anj=dTM7k!M4.FE:2jUF']wIg2E?cq-)Cf!]tbMHdFBv`J77yea../Z0rmIE<$X?EtCswDZk]tp`sP>FTHCqCy2H=qxfWmn`oW)fy*[R#tp)\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nX-Edge-Shopping-Flag: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"host":"edgeassetservice.azureedge.net","host_ip":"150.171.109.185:443","url":"/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2\nHost: edgeassetservice.azureedge.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nEdge-Asset-Group: ArbitrationService\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"host":"www.googleapis.com","host_ip":"142.251.41.170:443","url":"/chromewebstore/v1.1/items/verify","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /chromewebstore/v1.1/items/verify HTTP/2\nHost: www.googleapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nContent-Type: application/json\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"host":"edge-consumer-static.azureedge.net","host_ip":"150.171.109.177:443","url":"/mouse-gesture/config.json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /mouse-gesture/config.json HTTP/2\nHost: edge-consumer-static.azureedge.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Fetch-Site: none\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}],"processes":[{"pid":1728,"ppid":0,"name":"msedge.exe","command_line":"--profile-directory=Default","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00001728","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3588,"ppid":1728,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x2d0,0x7ff87bd40f18,0x7ff87bd40f24,0x7ff87bd40f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00003588"},{"pid":6884,"ppid":1728,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1696,i,9519178916515117035,15254102504638200826,262144 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2072 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00006884"},{"pid":4172,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1812,i,13061422025394498279,6350030595072068816,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2212 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00004172"},{"pid":6216,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2228,i,4771918741772925943,846914222251390626,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3832 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00006216"},{"pid":4248,"ppid":1728,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1776981128818887 --launch-time-ticks=2331855805 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=2820,i,9556576620986800428,5449795254000298767,2097152 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3868 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00004248"},{"pid":4216,"ppid":1728,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1776981128818887 --launch-time-ticks=2331856894 --skip-read-main-dll --metrics-shmem-handle=2832,i,4356749023252095277,7441433809138755268,2097152 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3888 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00004216"},{"pid":7916,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=4944,i,6202053717158613732,13917151947751520907,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5032 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00007916"},{"pid":6856,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=4936,i,12192726897702721955,11052642085807886201,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4988 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00006856"},{"pid":1152,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=4440,i,5383785748650255838,3217290611751497411,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=6128 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00001152"},{"pid":5196,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5816,i,223745254137425234,215161287072104422,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5096 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00005196"},{"pid":2044,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=5984,i,11353318058421546777,8705686422317816556,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5964 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00002044"},{"pid":7036,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=4808,i,13499422339196616823,16352901685494397159,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6120 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00007036"},{"pid":5520,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5436,i,2140900433811543396,2846827373478749992,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6028 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00005520"},{"pid":6748,"ppid":1728,"name":"msedge.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.16299.192 --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --skip-read-main-dll --metrics-shmem-handle=5860,i,17089744251069436985,17548717877061336962,262144 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5940 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00006748"},{"pid":5552,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=5088,i,2688827343165357725,10437236913781159024,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5880 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00005552"},{"pid":3900,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5928,i,16209096337043192152,3901578058291008019,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5108 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00003900"},{"pid":3624,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --skip-read-main-dll --metrics-shmem-handle=5876,i,1232484218496602701,2345838471693895696,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5540 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00003624"},{"pid":6952,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5708,i,2806914839298893620,10367351294084696634,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5904 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00006952"},{"pid":5932,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4868,i,12599449912394791256,966134927129270989,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=4796 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00005932"},{"pid":6312,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5760,i,16106186342245046923,7512323824375927841,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5740 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00006312"},{"pid":6428,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --skip-read-main-dll --metrics-shmem-handle=5088,i,16600415835653024425,382041761084325496,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=5976 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00006428"},{"pid":7604,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5768,i,13543943031638631978,1349044872214837277,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=5692 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00007604"},{"pid":7024,"ppid":1728,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6268,i,4166389425108558103,5527570262378662348,524288 --field-trial-handle=2076,i,1491613069301709370,5831453224144849630,262144 --variations-seed-version --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6256 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001728","uid":"00000000-00007024"},{"pid":5572,"ppid":0,"name":"_.exe","command_line":"","sha256":"346f5ff1750f46f19d671e47f5a40439ed90a3a19a6d0ef6f5e18de8d02f1d78","normalized_path":"C:\\_.exe","uid":"00000000-00005572","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":2960,"ppid":5572,"name":"readelf.exe","command_line":"PABg8","sha256":"8878d9ca6c06ccdcdc4c44d420470cfa8f95b2a743e9e061d1690b260c39c31c","normalized_path":"%ALLUSERSPROFILE%\\TO8zU\\readelf.exe","parent_uid":"00000000-00005572","uid":"00000000-00002960"},{"pid":4776,"ppid":5572,"name":"readelf.exe","command_line":"","sha256":"8878d9ca6c06ccdcdc4c44d420470cfa8f95b2a743e9e061d1690b260c39c31c","normalized_path":"%ALLUSERSPROFILE%\\TO8zU\\readelf.exe","parent_uid":"00000000-00005572","uid":"00000000-00004776"},{"pid":3320,"ppid":0,"name":"readelf.exe","command_line":"","sha256":"8878d9ca6c06ccdcdc4c44d420470cfa8f95b2a743e9e061d1690b260c39c31c","normalized_path":"%ALLUSERSPROFILE%\\TO8zU\\readelf.exe","uid":"00000000-00003320","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["dhcpcsvc.dll","twinapi.dll","dxgi.dll","msctf.dll","kernel32.dll","winsta.dll","rsaenh.dll","vcruntime140.dll","libEGL.dll","wscapi.dll","winmm.dll","DWrite.dll","msasn1.dll","d3d10warp.dll","FWPUCLNT.DLL","win32u.dll","profapi.dll","winmmbase.dll","setupapi.dll","atlthunk.dll","domain_actions.dll","cryptsp.dll","wwapi.dll","fltLib.dll","deviceassociation.dll","ntasn1.dll","sppc.dll","psapi.dll","msvcrt.dll","oleacc.dll","well_known_domains.dll","mfplat.dll","onnxruntime.dll","biwinrt.dll","sechost.dll","windows.storage.dll","netutils.dll","msvcp110_win.dll","TextInputFramework.dll","devobj.dll","d3d11.dll","dusmapi.dll","KernelBase.dll","oneauth.dll","Windows.Networking.Connectivity.dll","wlanapi.dll","tbs.dll","wevtapi.dll","libGLESv2.dll","clbcatq.dll","CoreUIComponents.dll","OneCoreUAPCommonProxyStub.dll","PCPKsp.dll","slc.dll","dbghelp.dll","D3D12.dll","shlwapi.dll","wtsapi32.dll","netapi32.dll","mswsock.dll","oneds.dll","rometadata.dll","ffmpeg.dll","telclient.dll","netprofm.dll","RTWorkQ.dll","ntmarta.dll","ole32.dll","CoreMessaging.dll","xmllite.dll","cfgmgr32.dll","gdi32.dll","dmcmnutils.dll","slwga.dll","microsoft_shell_integration.dll","ucrtbase.dll","rmclient.dll","ncrypt.dll","dxilconv.dll","cldapi.dll","rpcrt4.dll","shell32.dll","gpapi.dll","imm32.dll","dsreg.dll","crypt32.dll","dcomp.dll","npmproxy.dll","bcryptprimitives.dll","kernel.appcore.dll","dwmapi.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","Windows.Security.Authentication.OnlineId.dll","dpapi.dll","dhcpcsvc6.dll","DataExchange.dll","fwbase.dll","Windows.Devices.Enumeration.dll","taskschd.dll","dnsapi.dll","propsys.dll","sxs.dll","FirewallAPI.dll","imagehlp.dll","Windows.Security.Authentication.Web.Core.dll","cryptbase.dll","wintrust.dll","mscms.dll","ncryptprov.dll","MMDevAPI.dll","user32.dll","twinapi.appcore.dll","Windows.UI.Immersive.dll","iertutil.dll","nlaapi.dll","msvcp_win.dll","KBDUS.DLL","winhttp.dll","actxprxy.dll","vk_swiftshader.dll","rasadhlp.dll","mdmregistration.dll","oleaut32.dll","IPHLPAPI.DLL","nsi.dll","Windows.UI.dll","SHCore.dll","WinTypes.dll","linkinfo.dll","aepic.dll","ntdll.dll","advapi32.dll","gdi32full.dll","userenv.dll","bcrypt.dll","webauthn.dll","ResourcePolicyClient.dll","mf.dll","msedge_elf.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","sspicli.dll","Windows.System.Profile.RetailInfo.dll","d3dcompiler_47.dll","urlmon.dll","apphelp.dll","powrprof.dll","msedge.dll","secur32.dll","directmanipulation.dll","deviceaccess.dll","BitsProxy.dll","VxSSL64.dll","wkscli.dll","ws2_32.dll","wldp.dll","JhwRME7kax.dll","comctl32.dll","combase.dll","version.dll","uxtheme.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"JhwRME7kax.dll","sha256":"9fb08b8a197769666fce6f37ef98adac9f1429f2811d6c4feb6fde9be21041f7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-file-l1-1-0.dll","sha256":"5c9bc70586ad538b0df1fcf5d6f1f3527450ae16935aa34bd7eb494b4f1b2db9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-localization-l1-2-0.dll","sha256":"8664222823e122fca724620fd8b72187fc5336c737d891d3cef85f4f533b8de2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-processthreads-l1-1-0.dll","sha256":"a5b733e3dce21ab62bd4010f151b3578c6f1246da4a96d51ac60817865648dd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-winrt-error-l1-1-0.dll","sha256":"6f5ff5da32b35df5e93ca22eabe5e70905c2d87aa03953646fbf8905c8ee1658","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-winrt-error-l1-1-1.dll","sha256":"d0ffbe38cb3d5dae495c6e13ac4331b3839e7ed4fc4998dbbacc49c5113622cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-winrt-string-l1-1-0.dll","sha256":"978668512dbdf98a200b1f8f904e2e323d44780c6755e2245819afdfa5e0a501","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-xstate-l1-1-0.dll","sha256":"42e47d6452fe4e2b551989d4135c232288b490fa1ec72f92001ae7971a720eaa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-xstate-l2-1-0.dll","sha256":"18b5f45660328ab7ec1af517d535d8b1154c5700fd292301fb66b019cb890a40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-crt-convert-l1-1-0.dll","sha256":"5cf5bbb861608131b5f560cbf34a3292c80886b7c75357acc779e0bf98e16639","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-crt-math-l1-1-0.dll","sha256":"a768339f0b03674735404248a039ec8591fcba6ff61a3c6812414537badd23b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-crt-multibyte-l1-1-0.dll","sha256":"7101b3dff525ea47b7a40dd96544c944ae400447df7a6acd07363b6d7968b889","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-crt-private-l1-1-0.dll","sha256":"785c49fd9f99c6eb636d78887aa186233e9304921dd835dee8f72e2609ff65c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-crt-runtime-l1-1-0.dll","sha256":"d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-crt-stdio-l1-1-0.dll","sha256":"f9d3f380023a4c45e74170fe69b32bca506ee1e1fbe670d965d5b50c616da0cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-crt-string-l1-1-0.dll","sha256":"1a916c0db285deb02c0b9df4d08dad5ea95700a6a812ea067bd637a91101a9f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"msvcp140.dll","sha256":"def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"readelf.exe","sha256":"8878d9ca6c06ccdcdc4c44d420470cfa8f95b2a743e9e061d1690b260c39c31c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"vcruntime140.dll","sha256":"e429a6ec76ac249e942b94406a95463d6323769ebff11af6be8c828a219f14fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"vcruntime140_1.dll","sha256":"9b08624564115e6e38d86f188439a5cf65e37d7a9bbac05a2398181aecdcf63e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-console-l1-1-0.dll","sha256":"8f8b79150e850acc92fd6aab614f6e3759bea875134a62087d5dd65581e3001f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-console-l1-2-0.dll","sha256":"f5025e74de2c1c6ea74e475b57771ac32205e6f1fa6a0390298bbe1f4049ac5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-datetime-l1-1-0.dll","sha256":"913eaaa7997a6aee53574cffb83f9c9c1700b1d8b46744a5e12d76a1e53376fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-debug-l1-1-0.dll","sha256":"58a8d69df60ecbee776cd9a74b2a32b14bf2b0bd92d527ec5f19502a0d3eb8e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-errorhandling-l1-1-0.dll","sha256":"46079c0a1b660fc187aafd760707f369d0b60d424d878c57685545a3fce95819","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-file-l1-2-0.dll","sha256":"629e52ba4e2dca91b10ef7729a1722888e01284eed7dda6030d0a1ec46c94086","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-file-l2-1-0.dll","sha256":"dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-handle-l1-1-0.dll","sha256":"0b3dfb8554ead94d5da7859a12db353942406f9d1dfe3fac3d48663c233ea99d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-heap-l1-1-0.dll","sha256":"c43075b1d2386a8a262de628c93a65350e52eae82582b27f879708364b978e29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-interlocked-l1-1-0.dll","sha256":"c23fe8d5c3ca89189d11ec8df983cc144d168cb54d9eab5d9532767bcb2f1fa3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-libraryloader-l1-1-0.dll","sha256":"f320f9c0463de641b396ce7561af995de32211e144407828b117088cf289df91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-memory-l1-1-0.dll","sha256":"5d9767d8cca0fbfd5801bff2e0c2adddd1baaaa8175543625609abce1a9257bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-namedpipe-l1-1-0.dll","sha256":"8e015cdf2561450ed9a0773be1159463163c19eab2b6976155117d16c36519da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-processenvironment-l1-1-0.dll","sha256":"058eb7ce88c22d2ff7d3e61e6593ca4e3d6df449f984bf251d9432665e1517d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-processthreads-l1-1-1.dll","sha256":"1ef06c600c451e66e744b2ca356b7f4b7b88ba2f52ec7795858d21525848ac8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-profile-l1-1-0.dll","sha256":"e63550608dd58040304ea85367e9e0722038ba8e7dc7bf9d91c4d84f0ec65887","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-rtlsupport-l1-1-0.dll","sha256":"91508ab353b90b30ff2551020e9755d7ab0e860308f16c2f6417dfb2e9a75014","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-string-l1-1-0.dll","sha256":"f3a7a9c98ebe915b1b57c16e27fffd4ddf31a82f0f21c06fe292878e48f5883e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-synch-l1-1-0.dll","sha256":"d6708d1254ed88a948871771d6d1296945e1aa3aeb7e33e16cc378f396c61045","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-synch-l1-2-0.dll","sha256":"72c639d1afda32a65143bcbe016fe5d8b46d17924f5f5190eb04efe954c1199a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-sysinfo-l1-1-0.dll","sha256":"76d8e4ed946deefeefa0d0012c276f0b61f3d1c84af00533f4931546cbb2f99e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-timezone-l1-1-0.dll","sha256":"b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-core-util-l1-1-0.dll","sha256":"f28a8fe2cd7e8e00b6d2ec273c16db6e6eea9b6b16f7f69887154b6228af981e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-crt-conio-l1-1-0.dll","sha256":"e677497c1baefffb33a17d22a99b76b7fa7ae7a0c84e12fda27d9be5c3d104cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-crt-environment-l1-1-0.dll","sha256":"b7ee468f5b6c650dada7db3ad9e115a0e97135b3df095c3220dfd22ba277b607","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-crt-filesystem-l1-1-0.dll","sha256":"7102f8d9d0f3f689129d7fe071b234077fba4dd3687071d1e2aeaa137b123f86","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-crt-heap-l1-1-0.dll","sha256":"f5183b8d7462c01031992267fe85680ab9c5b279bedc0b25ab219f7c2184766f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-crt-locale-l1-1-0.dll","sha256":"2eb96422375f1a7b687115b132a4005d2e7d3d5dc091fb0eb22a6471e712848e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-crt-process-l1-1-0.dll","sha256":"3af38920e767bd9ebc08f88eaf2d08c748a267c7ec60eab41c49b3f282a4cf65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-crt-time-l1-1-0.dll","sha256":"b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":"api-ms-win-crt-utility-l1-1-0.dll","sha256":"dd14133adf5c534539298422f6c4b52739f80aca8c5a85ca8c966dea9964ceb1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"name":".crash","sha256":"42f0d088e60c483fba8f311c3334393b95933c659c202e79d38f78cc105f98aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]}],"files_written":[{"path":"%ALLUSERSPROFILE%\\dc8780bb-4357-9b61-f72c-316153e4a081.tmp","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%TEMP%\\is-2779946581.tmp","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\.crash","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-console-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-console-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-datetime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-debug-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-errorhandling-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-file-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-file-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-file-l2-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-handle-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-interlocked-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-libraryloader-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-localization-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-memory-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-namedpipe-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-processenvironment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-processthreads-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-processthreads-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-profile-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-rtlsupport-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-synch-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-synch-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-sysinfo-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-timezone-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-util-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-winrt-error-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-winrt-error-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-winrt-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-xstate-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-core-xstate-l2-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-crt-conio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-crt-convert-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-crt-environment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-crt-filesystem-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-crt-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-crt-locale-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-crt-math-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-crt-multibyte-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-crt-private-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-crt-process-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-crt-runtime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-crt-stdio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-crt-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-crt-time-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\api-ms-win-crt-utility-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\JhwRME7kax.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\msvcp140.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\vcruntime140_1.dll","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%ALLUSERSPROFILE%\\TO8zU\\readelf.exe","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%TEMP%\\abff69ec-0531-de64-d731-20f5c46bbe12.tmp","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%TEMP%\\6f3bad28-c1f5-1aa0-13f5-e43100af7ad6.tmp","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]},{"path":"%TEMP%\\6e3aac29-c0f4-1ba1-12f4-e53001ae7bd7.tmp","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"69ea3ae42626cb0f6c004f93"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["69ea3ae42626cb0f6c004f93"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample 346f5ff1750f… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 346f5ff1750f…. Threat score 85/100. 0/26 AV engines flagged this file. 3 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/346f5ff1750f46f19d671e47f5a40439ed90a3a19a6d0ef6f5e18de8d02f1d78"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 346f5ff1750f… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 346f5ff1750f…. Threat score 85/100. 0/26 AV engines flagged this file. 3 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/346f5ff1750f46f19d671e47f5a40439ed90a3a19a6d0ef6f5e18de8d02f1d78"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 346f5ff1750f… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 346f5ff1750f…. Threat score 85/100. 0/26 AV engines flagged this file. 3 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5d","11",{}]]