21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 5f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T46b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware_ Sample 3ba215692665… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3ba215692665…. Malware family: Malware_. Threat score 100/100. 1/23 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","keywords":["Malicious","Malware_","malware analysis","sandbox report","threat intelligence","3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3"],"about":{"@type":"SoftwareApplication","name":"LA.exe","applicationCategory":["compressed","innosetup"],"identifier":"3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware_","antivirusDetections":{"malicious":1,"total":23},"behavioralIndicators":{"malicious":7,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T692,"SOFTWARE\Microsoft\.NETFramework" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: sample.bin, "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: sample.bin, "SOFTWARE\Microsoft\NET Framework Setup\NDP\" in Source: sample.bin, "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: sample.bin, "System\CurrentControlSet\Control\Windows" in Source: sample.bin, "Software\Borland\Locales" in Source: sample.bin, "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: sample.bin, "Software\Embarcadero\Locales" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion" in Source: sample.bin, "Software\Borland\Delphi\Locales" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: sample.bin, "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: sample.bin, "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: sample.bin, "System\CurrentControlSet\Control\ProductOptions" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: sample.bin, "Software\CodeGear\Locales" in Source: sample.bin23:T10da,Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEvent"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process2"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyEx"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFile"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteEx"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterClass"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCompareUnicodeString"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "CreateNamedPipe"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "TransactNamedPipe"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "VerSetConditionMask"; Source: "sample.bin"), Found reference to API (Indicator: "GetLongPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileEx"; Source: "sample.bin"), Found reference to API (Indicator: "DisplayVersion"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "AnimateWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemWow64DirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemWow64DirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "SetNamedPipeHandleState"; Source: "sample.bin"), Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadPreferredUILanguages"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimes"; Source: "sample.bin"), Found reference to API (Indicator: "WakeConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringOrdinal"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadPreferredUILanguages"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "sample.bin")24:T9c9,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "LA.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "LA.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "LA.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "::WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "__crtCreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007100.00000000.226397.52711000.00000002.mdmp") Found reference to API "__crtCreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007100.00000000.226397.52711000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007100.00000000.226397.52711000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007100.00000000.226397.52711000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007100.00000000.226397.52711000.00000002.mdmp")25:T810,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "LA.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "LA.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "LA.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp")26:T8cd,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "LA.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "LA.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "LA.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "LA.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.6BF95000.00000002.mdmp, 00000000-00007100.00000001.226895.684F4000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.6BF95000.00000002.mdmp, 00000000-00007100.00000001.226895.684F4000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "__crtFreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00007100.00000000.226397.52711000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00007100.00000000.226397.52711000.00000002.mdmp")27:T801,Found string "!"#$%&'()*+,-./0123ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "LA.exe"), Found string "!"#$%&'()*+ -./0123ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "LA.exe"), file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp"), file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp"), file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp"), file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp")28:T44d,"identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\APPEXTENSION\DATA\5B") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\APPLICATIONEXTENSION\DATA\298") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\APPLICATIONEXTENSION\DATA\298") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\APPLICATION\DATA\BD") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\APPLICATION\DATA\BD") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\APPEXTENSION\DATA\5D") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\APPEXTENSION\DATA\5D")29:T95e,"LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2389941884 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2389948461 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2390139189 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2391743513 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2391749878 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2391934691 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2391941058 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392157389 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392164027 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392307064 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392313702 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392360182 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392366724 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392420114 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392426256 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392508897 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392515222 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392565975 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392572358 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392622705 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392628728 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392679455 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392685718 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392737290 [PID: 4004] "LA.exe" queried SystemProcessInformation at 00000000-00004004-00000C15-2392743763 [PID: 4004]2a:T11bb,Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00003144.00000000.220668.749C0000.00000004.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptDeriveKeyPBKDF2" (Indicator: "BCryptDeriveKey"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptDeriveKeyPBKDF2" (Indicator: "BCryptDeriveKeyPBKDF2"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptDeriveKeyPBKDF2" (Indicator: "CryptDeriveKey"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp")2b:T6cf,Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00004004-00000C2C-2392301020") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00004004-00000C2C-2392301138") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00004004-00000C2C-2392301247") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004004-00000C2C-2392301361") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004004-00000C2C-2392301698") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp")2c:T9dcd,Contains base64 string in header "/async/folae" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "534=" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "GKYE" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "s8Gx80ZvnCU7" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /async/ddljson?async=ntp:2 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /async/ddljson?async=ntp:2 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /async/ddljson?async=ntp:2 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "GET /async/ddljson?async=ntp:2 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "534=" in header "GET /async/ddljson?async=ntp:2 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "GKYE" in header "GET /async/ddljson?async=ntp:2 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "s8Gx80ZvnCU7" in header "GET /async/ddljson?async=ntp:2 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /async/ddljson?async=ntp:2 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /async/ddljson?async=ntp:2 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /async/ddljson?async=ntp:2 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "/complete/search" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "omni" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "ansg" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "BNhE" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "534=" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "GKYE" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "s8Gx80ZvnCU7" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Data" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "CKmdygEIveDKAQiTocsBCIWgzQE=" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Priority" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "534=" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "GKYE" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "s8Gx80ZvnCU7" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Data" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "CKmdygEIveDKAQiTocsBCIWgzQE=" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Priority" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /async/newtab_promos HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /async/newtab_promos HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /async/newtab_promos HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "GET /async/newtab_promos HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /async/newtab_promos HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /async/newtab_promos HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /async/newtab_promos HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty"2d:T39b6,Found XOR loop in file "sample.bin" at offset 115672; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 115807; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1417508; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1417645; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1433020; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1433720; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1434860; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1467438; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2393887; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2985765; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3263311; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3282308; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3301546; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3338494; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3360416; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3419504; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3576151; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3589523; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3657126; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3696825; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3736959; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3746759; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3763190; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3855279; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3904125; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3904401; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3945002; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4021306; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4021317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4062140; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4192007; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4199338; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4364842; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4375697; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4435823; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4456683; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4574062; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4621676; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4753993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4763627; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4792121; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4827449; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4904823; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5101196; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5122964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5175511; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 182738; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 604310; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 604376; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 604934; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 605000; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 605248; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 605302; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 701665; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2673325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2975612; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2994365; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3151865; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3244063; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3280124; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3300268; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3334775; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3385766; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3395612; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3538992; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3545986; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3576400; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3594985; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3603644; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3633358; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3684031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3962925; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3980645; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4030888; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4052246; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4159751; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4336164; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4341245; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4389801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4460852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4598114; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4601255; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4618074; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4652993; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4741217; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4766623; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4804631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4863963; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4871062; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4898360; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4977962; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5134110; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5220977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5221017; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5223155; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5226191; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5226952; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5228385; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5228430; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5230236; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5230529; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5230797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5234240; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5234422; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5235766; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5236084; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5236603; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5236681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5237002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5237351; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5237527; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5237545; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5237901; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5238206; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5239080; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5240186; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5241504; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5241556; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5242452; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5243331; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5244971; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5245452; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5246360; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5246376; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5246809; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5249075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5250560; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5251341; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5252983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5253613; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 154976; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 155003; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 155413; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 155440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 155679; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 155703; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 155928; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 156009; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 156032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 156056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 156084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 156108; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 205886; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 574115; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1188957; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1193674; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1221964; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1224807; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1234737; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1268576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2085880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2093773; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2093892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2094052; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2094464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2110887; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2215311; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2273455; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2647394; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2922774; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3101412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3162705; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3193849; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3278638; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3292188; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3329559; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3365888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3397481; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3428892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3508769; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3609864; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3659954; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3746758; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3797888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3850284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3911072; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3913461; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3913756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3992740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4021305; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4059844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4136896; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4137144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4332521; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4336358; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4357379; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4425534; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4427134; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4519740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4561512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4572766; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4645036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4744549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4789437; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4812334; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4911549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5065534; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5210133; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5215539; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5258139; code bytes = 80302e:T5e6,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "LA.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.52711000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "__crtGetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00007100.00000000.226397.52711000.00000002.mdmp")2f:Tb0d,Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "LA.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "LA.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "LA.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "LA.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "LA.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "LA.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "LA.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "LA.exe") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "findwindow"; File: "LA.exe") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "findwindow"; File: "LA.exe") Found reference to API "function SendMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Longint;" (Indicator: "sendmessage"; File: "LA.exe") Found reference to API "function PostMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Boolean;" (Indicator: "postmessage"; File: "LA.exe") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; File: "LA.exe") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; File: "LA.exe") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; File: "LA.exe") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; File: "LA.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp") Found reference to API "Mojo.Channel.WriteSendMessageProcessType" (Indicator: "sendmessage"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp")30:T18a5,"LA.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004004) "LA.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000000000000010f819000ae65b7514ff19008226a374aa7651a0feffffffc8fe19003ce2a274630c0000d8fe19004fe2a27400000000000000000000000000106c0020ff190042534000c8fe190044000000045ab700e459b700d059b7000000000000000000000000000000000000000000000000000000000000000000000000000000000019de67751201000000106c00cd034100c9106c0028ff1900d7106c00de106c00 (UID: 00000000-00004004) "LA.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000001900d7087b77f8a0b700000000008403fe7f00000000f0008574000000008d26f520ec617e775fd67a7740020000f8a0b700350100c09093b800180000000000000000d11900400800000000000000000000000000000100000036058097ecd01900350100c0d8d01900b4d0190055cf7a770000000000d119000000000048020000e0ce7a77f8a0b70000000000000000006dc47a7700000000f8a0b70096c47a77900000000000000000000000000000000100000040d41900000000001600180058deb70040ceb70066ceb7000000000108d1190000003f003f005c0000118874feffffff49004e0044004f0000000000000000005900530034d11900 (UID: 00000000-00004004) "LA.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004004) "LA.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004004) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003144) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c9381178fb7f00008000000000000000000000000000000030019e746a0200001033607afb7f0000000000000000000000008d79fb7f000060f3e7b29200000010410e78fb7f000040379d746a02000020f3e7b292000000000000000000000000000000000000000100000000000000b8400e78fb7f00001607000000000000010000000000000000008d79fb7f00003b4dd577fb7f00000000000000000000d8f7e7b2920000000000000000000000d02a9f79fb7f000010b3057afb7f0000e8f80d78fb7f000010b3057afb7f0000d02a9f79fb7f00000d000000fb7f00000d00000000000000a0f6f579fb7f0000f5879a79fb7f0000d02a9f79 (UID: 00000000-00003144) "identity_helper.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007100) "identity_helper.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007100) "identity_helper.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000003b4dd577fb7f0000d07e67deeb010000000000000000000058b64864fb7f00001033607afb7f0000000000000000000000000564fb7f000020bfd6654800000010410e78fb7f00000000000000000000e0bed66548000000000000000000000000000000000000000100000000000000b8400e78fb7f0000f003000000000000010000000000000000000564fb7f00003b4dd577fb7f0000000000000000000098c3d665480000000000000000000000a0441664fb7f0000d09a4864fb7f0000e8f80d78fb7f0000d09a4864fb7f0000a0441664fb7f00000d000000000000000d000000fb7f000048cd3a64fb7f0000059e0f64fb7f0000a0441664 (UID: 00000000-00007100)31:T530,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "LA.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "LA.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "LA.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.52711000.00000002.mdmp, 00000000-00007100.00000000.226397.6BF95000.00000002.mdmp, 00000000-00007100.00000001.226895.684F4000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp")32:T64d,Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "LA.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "LA.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "LA.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "LA.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "LA.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "LA.exe") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "FindWindow"; File: "LA.exe") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "FindWindow"; File: "LA.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp")33:Te78,"LA.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter msvcrt (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter Mscoree (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter OleAut32 (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter Ole32 (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0 (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter Shell32 (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter Shlwapi (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter DXGI (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter WinTrust (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004004) "LA.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004004) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007100) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007100) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00007100) "identity_helper.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007100) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007100) "identity_helper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007100) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007100) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007100) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007100) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00007100) "identity_helper.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Edge\Application\145.0.3800.58\msedge.dll (UID: 00000000-00007100) "identity_helper.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007100) "identity_helper.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007100) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007100) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007100) "identity_helper.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007100) "identity_helper.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007100)34:T4a64,"LA.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter RtlDecompressBuffer (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter srand (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter _time64 (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter _amsg_exit (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter ??_U@YAPAXI@Z (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter ??_V@YAXPAX@Z (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter _stricmp (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter qsort (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter _errno (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter memchr (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter _wcsdup (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter _snwprintf (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter _strdup (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter realloc (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter memset (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter strcmp (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter strrchr (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter _snprintf (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter _localtime64_s (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter _mktime64 (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter _ftol2 (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter _CxxThrowException (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter ??1type_info@@UAE@XZ (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter rand (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter tolower (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter towlower (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter ??3@YAXPAX@Z (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter ??2@YAPAXI@Z (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter atoi (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter mbstowcs (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter __CxxFrameHandler3 (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter _wcsicmp (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter InternetOpenW (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter InternetOpenUrlW (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter OutputDebugStringA (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter OpenThread (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter GetFileTime (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter Thread32Next (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter Thread32First (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter lstrcatW (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter InterlockedExchange (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter InterlockedCompareExchange (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter FlushInstructionCache (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter BCryptDeriveKeyPBKDF2 (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter BCryptEncrypt (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00004004) "LA.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00004004) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003144) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003144) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003144) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003144) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003144) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003144) "identity_helper.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter RtlGetDeviceFamilyInfoEnum (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter PrefetchVirtualMemory (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter ChromeMain (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsGetStringRawBuffer (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007100) "identity_helper.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00007100)35:Tb68,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "LA.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "LA.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "LA.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "LA.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "__crtCreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007100.00000000.226397.52711000.00000002.mdmp") Found reference to API "__crtCreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007100.00000000.226397.52711000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007100.00000000.226397.52711000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007100.00000000.226397.52711000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007100.00000000.226397.52711000.00000002.mdmp")36:T602,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "LA.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "LA.exe") Found reference to API "DllGetLastError" (Indicator: "GetLastError"; File: "LA.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.52711000.00000002.mdmp, 00000000-00007100.00000000.226397.6BF95000.00000002.mdmp, 00000000-00007100.00000001.226895.684F4000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.6BF95000.00000002.mdmp, 00000000-00007100.00000001.226895.684F4000.00000002.mdmp") Found reference to API "?_XGetLastError@std@@YAXXZ" (Indicator: "GetLastError"; Source: "00000000-00007100.00000000.226397.52711000.00000002.mdmp")37:T90b,Process LA.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4004:168:WilStaging_02" Process LA.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4004:168:WilStaging_02" Process LA.exe created mutex with name "\Sessions\1\BaseNamedObjects\minhook_multihook_00000FA4" Process LA.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4004:304:WilStaging_02" Process LA.exe created mutex with name "\Sessions\1\BaseNamedObjects\UAPUVUNIQCIYYEBCSFLVSXTHREOJKNE" Process LA.exe created mutex with name "minhook_multihook_00000FA4" Process LA.exe created mutex with name "Local\SM0:4004:168:WilStaging_02" Process LA.exe created mutex with name "UAPUVUNIQCIYYEBCSFLVSXTHREOJKNE" Process LA.exe created mutex with name "SM0:4004:168:WilStaging_02" Process LA.exe created mutex with name "SM0:4004:304:WilStaging_02" Process Dllhost.exe created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process Dllhost.exe created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process Dllhost.exe created mutex with name "SM0:1044:168:WilStaging_02" Process Dllhost.exe created mutex with name "RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process Dllhost.exe created mutex with name "Local\SM0:1044:168:WilStaging_02" Process Dllhost.exe created mutex with name "692950069" Process Dllhost.exe created mutex with name "RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process Dllhost.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1044:168:WilStaging_02" Process Dllhost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1044:168:WilStaging_02" Process Dllhost.exe created mutex with name "\Sessions\1\BaseNamedObjects\692950069" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3144:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3144:304:WilStaging_02" Process rundll32.exe created mutex with name "SM0:3144:304:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:3144:304:WilStaging_02" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8008:304:WilStaging_02"38:T2afd,"ISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004004.00000001.219138.00B70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007100.00000000.226397.02E50000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00007100.00000000.226397.02E50000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp "Software\" in Source: 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp "PSModu\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000000.226397.DE674000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000000.226397.DE674000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000000.226397.DE674000.00000004.mdmp "S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe" in Source: 00000000-00007100.00000000.226397.DE674000.00000004.mdmp "y\Machine\Software\Classes\I" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{679C64B7-81AB-42C2-8819-C958767753F4}" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{0450CE77-AF0D-40AC-93FD-1E5D48C89419}" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{61424521-07B6-40D2-9323-B78CDAE5EB61}" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace_36354489" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Shell\Update" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\PSR" in Source: 00000000-00007100.00000000.226397.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000000.226397.E3B13000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000000.226397.E3B13000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000000.226397.E3B13000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000000.226397.E3B13000.00000004.mdmp "PSModu\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000001.226895.DE674000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000001.226895.DE674000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000001.226895.DE674000.00000004.mdmp "S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe" in Source: 00000000-00007100.00000001.226895.DE674000.00000004.mdmp "y\Machine\Software\Classes\I" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{679C64B7-81AB-42C2-8819-C958767753F4}" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{0450CE77-AF0D-40AC-93FD-1E5D48C89419}" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{61424521-07B6-40D2-9323-B78CDAE5EB61}" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace_36354489" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Shell\Update" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\PSR" in Source: 00000000-00007100.00000001.226895.DE689000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000001.226895.E3B13000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000001.226895.E3B13000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000001.226895.E3B13000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000001.226895.E3B13000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000001.226895.E3B24000.00000004.mdmp "Micro\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}H" in Source: 00000000-00007100.00000001.226895.E3B24000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007100.00000001.226895.E3B24000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007624.00000000.226073.02E50000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00007624.00000000.226073.02E50000.00000002.mdmp39:T576,Launches browser "chrome.exe" (UID: 00000000-00008008) Launches browser "chrome.exe" (UID: 00000000-00002740) Launches browser "chrome.exe" (UID: 00000000-00002464) Launches browser "chrome.exe" (UID: 00000000-00001636) Launches browser "chrome.exe" (UID: 00000000-00006568) Launches browser "chrome.exe" (UID: 00000000-00007740) Launches browser "chrome.exe" (UID: 00000000-00007412) Launches browser "chrome.exe" (UID: 00000000-00004112) Launches browser "chrome.exe" (UID: 00000000-00006244) Launches browser "msedge.exe" (UID: 00000000-00002396) Launches browser "msedge.exe" (UID: 00000000-00002436) Launches browser "msedge.exe" (UID: 00000000-00008036) Launches browser "msedge.exe" (UID: 00000000-00007676) Launches browser "msedge.exe" (UID: 00000000-00007120) Launches browser "msedge.exe" (UID: 00000000-00001064) Launches browser "msedge.exe" (UID: 00000000-00002804) Launches browser "chrome.exe" (UID: 00000000-00008092) Launches browser "chrome.exe" (UID: 00000000-00002128) Launches browser "chrome.exe" (UID: 00000000-00004952) Launches browser "chrome.exe" (UID: 00000000-00002608) Launches browser "chrome.exe" (UID: 00000000-00001748) Launches browser "chrome.exe" (UID: 00000000-00005200) Launches browser "msedge.exe" (UID: 00000000-00002380) Launches browser "chrome.exe" (UID: 00000000-00006828) Launches browser "msedge.exe" (UID: 00000000-00008012)3a:T1895,"LA.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 748b0000 "LA.exe" loaded module "NTDLL.DLL" at base 77770000 "LA.exe" loaded module "MSVCRT" at base 76950000 "LA.exe" loaded module "NTDLL" at base 77770000 "LA.exe" loaded module "USER32.DLL" at base 76180000 "LA.exe" loaded module "MSCOREE" at base 74850000 "LA.exe" loaded module "OLEAUT32" at base 75e20000 "LA.exe" loaded module "OLE32" at base 75f90000 "LA.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0" at base 75960000 "LA.exe" loaded module "SHELL32" at base 770f0000 "LA.exe" loaded module "SHLWAPI" at base 768f0000 "LA.exe" loaded module "ADVAPI32" at base 75730000 "LA.exe" loaded module "GDI32.DLL" at base 75700000 "LA.exe" loaded module "DXGI" at base 74780000 "LA.exe" loaded module "WINTRUST" at base 76510000 "LA.exe" loaded module "MSVCRT.DLL" at base 76950000 "LA.exe" loaded module "WININET.DLL" at base 74d40000 "LA.exe" loaded module "SHLWAPI.DLL" at base 768f0000 "LA.exe" loaded module "KERNEL32.DLL" at base 76590000 "LA.exe" loaded module "ADVAPI32.DLL" at base 75730000 "LA.exe" loaded module "SHELL32.DLL" at base 770f0000 "LA.exe" loaded module "BCRYPT.DLL" at base 74750000 "LA.exe" loaded module "KERNELBASE" at base 75480000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb50640000 "rundll32.exe" loaded module "SHELL32.DLL" at base 7ffb798d0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb75000000 "identity_helper.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb4ff80000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb77d10000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb77d10000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffb77d10000 "identity_helper.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffb78330000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb77d10000 "identity_helper.exe" loaded module "KERNEL32" at base 7ffb79630000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb77d10000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb77d10000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb77d10000 "identity_helper.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 7ffb78a30000 "identity_helper.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGE\APPLICATION\145.0.3800.58\MSEDGE.DLL" at base 7ffb1d060000 "identity_helper.exe" loaded module "ADVAPI32.DLL" at base 7ffb783b0000 "identity_helper.exe" loaded module "USER32.DLL" at base 7ffb7a1b0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb75000000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffb786a0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffb786a0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\EXECMODELCLIENT.DLL" at base 7ffb60e20000 "identity_helper.exe" loaded module "RPCRT4.DLL" at base 7ffb79380000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffb786a0000 "identity_helper.exe" loaded module "OLE32.DLL" at base 7ffb79100000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.APPCORE.DLL" at base 7ffb71160000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WPNAPPS.DLL" at base 7ffb5d670000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 7ffb63d80000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\EXECMODELPROXY.DLL" at base 7ffb602e0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffb70b40000 "identity_helper.exe" loaded module "NTDLL.DLL" at base 7ffb7a5b0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.APPLICATIONMODEL.DLL" at base 7ffb61000000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb78330000 "identity_helper.exe" loaded module "COMBASE.DLL" at base 7ffb786a0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTOWINRT.DLL" at base 7ffb58d70000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffb75890000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\TILEDATAREPOSITORY.DLL" at base 7ffb5e3e0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\USERMGRPROXY.DLL" at base 7ffb62060000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffb63970000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\BIWINRT.DLL" at base 7ffb63790000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.INTERNAL.SHELL.BROKER.DLL" at base 7ffb59020000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\STARTTILEDATA.DLL" at base 7ffb5de10000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSUDK.SHELLCOMMON.DLL" at base 7ffb64050000 "identity_helper.exe" loaded module "API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL" at base 7ffb780c0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\APPXDEPLOYMENTCLIENT.DLL" at base 7ffb6e4d0000 "identity_helper.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1.DLL" at base 7ffb76a20000 "identity_helper.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 7ffb76a20000 "identity_helper.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ffb77d10000 "identity_helper.exe" loaded module "EXT-MS-ONECORE-APPMODEL-STATEREPOSITORY-CACHE-L1-1-0.DLL" at base 7ffb6e120000 "identity_helper.exe" loaded module "EXT-MS-ONECORE-APPMODEL-STATEREPOSITORY-CACHE-L1-1-2.DLL" at base 7ffb6e120000 "identity_helper.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-INTERNAL-L1-1-2.DLL" at base 7ffb76a20000 "identity_helper.exe" loaded module "STARTMENU.DLL" at base 7ffb59140000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.APPLICATIONDATA.DLL" at base 7ffb59d50000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffb716c0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffb759d00003b:T3ee3,Process "Dllhost.exe" (UID: 00000000-00001044) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-8LD9T6N", PROCESSOR_ARCHITEW6432="AMD64"" Process "Dllhost.exe" (UID: 00000000-00001044) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "rundll32.exe" (UID: 00000000-00003144) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "rundll32.exe" (UID: 00000000-00003144) was launched with missing environment variables: "USERDNSDOMAIN, PROCESSOR_ARCHITEW6432" Process "chrome.exe" (UID: 00000000-00008008) was launched with new environment variables: "EFC_5408="1", USERDNSDOMAIN="DESKTOP-8LD9T6N"" Process "chrome.exe" (UID: 00000000-00008008) was launched with modified environment variables: "PSModulePath, Path" Process "chrome.exe" (UID: 00000000-00002464) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_8008_OUTTYZCHLLQTHHRS"" Process "chrome.exe" (UID: 00000000-00006568) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, EFC_5408, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "chrome.exe" (UID: 00000000-00006244) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="DESKTOP-8LD9T6N", LOGONSERVER="\\DESKTOP-8LD9T6N", EFC_5408="1", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="%OSUSER%", USERDNSDOMAIN="DESKTOP-8LD9T6N", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", OS="Windows_NT", COMPUTERNAME="DESKTOP-8LD9T6N", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "msedge.exe" (UID: 00000000-00002396) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00002396) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME" Process "msedge.exe" (UID: 00000000-00002436) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_2396_JSSJWSKHGPVGKFLM", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="2396"" Process "msedge.exe" (UID: 00000000-00008036) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="48", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="1918044760612785876"" Process "msedge.exe" (UID: 00000000-00007120) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, EFC_5408, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CURL_CA_BUNDLE, PATHEXT, DriverData, ProgramData, ProgramW6432, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, windir, USERDOMAIN, LOGONSERVER, OneDrive, APPDATA, CommonProgramFiles, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, HOMEDRIVE, USERPROFILE, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS, EDGE_METRICS_CLIENT_ID_HASH" Process "chrome.exe" (UID: 00000000-00008092) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_8008_OUTTYZCHLLQTHHRS"" Process "chrome.exe" (UID: 00000000-00008092) was launched with modified environment variables: "Path" Process "chrome.exe" (UID: 00000000-00008092) was launched with missing environment variables: "COMPONENT_INSTALLER_DIR, EDGE_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "chrome.exe" (UID: 00000000-00002608) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="DESKTOP-8LD9T6N", LOGONSERVER="\\DESKTOP-8LD9T6N", EFC_5408="1", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="%OSUSER%", USERDNSDOMAIN="DESKTOP-8LD9T6N", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", OS="Windows_NT", COMPUTERNAME="DESKTOP-8LD9T6N", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "chrome.exe" (UID: 00000000-00001748) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, EFC_5408, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "msedge.exe" (UID: 00000000-00002380) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", EFC_5408="1", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="48", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="%OSUSER%", USERDNSDOMAIN="DESKTOP-8LD9T6N", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", windir="C:\WINDOWS", EDGE_BROWSER_PID="2396", USERDOMAIN="DESKTOP-8LD9T6N", LOGONSERVER="\\DESKTOP-8LD9T6N", EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_2396_JSSJWSKHGPVGKFLM", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", CommonProgramFiles="%PROGRAMFILES%\Common Files", OS="Windows_NT", COMPUTERNAME="DESKTOP-8LD9T6N", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", HOMEDRIVE="C:", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", NUMBER_OF_PROCESSORS="2", EDGE_METRICS_CLIENT_ID_HASH="1918044760612785876"" Process "msedge.exe" (UID: 00000000-00002380) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00002380) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME" Process "chrome.exe" (UID: 00000000-00006828) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_8008_OUTTYZCHLLQTHHRS"" Process "chrome.exe" (UID: 00000000-00006828) was launched with modified environment variables: "Path" Process "chrome.exe" (UID: 00000000-00006828) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, COMPONENT_INSTALLER_DIR, EDGE_USER_DATA_DIR, EDGE_BROWSER_PID, EDGE_CRASHPAD_PIPE_NAME, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00008012) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_2396_JSSJWSKHGPVGKFLM", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="2396"" Process "msedge.exe" (UID: 00000000-00008012) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00008012) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, EFC_5408, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CHROME_CRASHPAD_PIPE_NAME, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "msedge.exe" (UID: 00000000-00006360) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", EFC_5408="1", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="48", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="%OSUSER%", USERDNSDOMAIN="DESKTOP-8LD9T6N", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", windir="C:\WINDOWS", USERDOMAIN="DESKTOP-8LD9T6N", LOGONSERVER="\\DESKTOP-8LD9T6N", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", CommonProgramFiles="%PROGRAMFILES%\Common Files", OS="Windows_NT", COMPUTERNAME="DESKTOP-8LD9T6N", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", HOMEDRIVE="C:", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", NUMBER_OF_PROCESSORS="2", EDGE_METRICS_CLIENT_ID_HASH="1918044760612785876"" Process "identity_helper.exe" (UID: 00000000-00007624) was launched with new environment variables: "EFC_5408="1", EDGE_METRICS_SESSION_ID="48", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERDNSDOMAIN="DESKTOP-8LD9T6N", EDGE_BROWSER_PID="2396", EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_2396_JSSJWSKHGPVGKFLM", EDGE_METRICS_CLIENT_ID_HASH="1918044760612785876"" Process "identity_helper.exe" (UID: 00000000-00007624) was launched with modified environment variables: "PSModulePath, Path" Process "msedge.exe" (UID: 00000000-00007556) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, EFC_5408, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CURL_CA_BUNDLE, PATHEXT, DriverData, ProgramData, ProgramW6432, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, windir, USERDOMAIN, LOGONSERVER, OneDrive, APPDATA, CommonProgramFiles, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, HOMEDRIVE, USERPROFILE, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007348) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", EFC_5408="1", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="48", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="%OSUSER%", USERDNSDOMAIN="DESKTOP-8LD9T6N", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", windir="C:\WINDOWS", USERDOMAIN="DESKTOP-8LD9T6N", LOGONSERVER="\\DESKTOP-8LD9T6N", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", CommonProgramFiles="%PROGRAMFILES%\Common Files", OS="Windows_NT", COMPUTERNAME="DESKTOP-8LD9T6N", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", HOMEDRIVE="C:", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", NUMBER_OF_PROCESSORS="2", EDGE_METRICS_CLIENT_ID_HASH="1918044760612785876"" Process "msedge.exe" (UID: 00000000-00004348) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, EFC_5408, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CURL_CA_BUNDLE, PATHEXT, DriverData, ProgramData, ProgramW6432, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, windir, USERDOMAIN, LOGONSERVER, OneDrive, APPDATA, CommonProgramFiles, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, HOMEDRIVE, USERPROFILE, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS, EDGE_METRICS_CLIENT_ID_HASH"3c:Tcf0,Spawned process "Dllhost.exe" (UID: 00000000-00001044) Spawned process "rundll32.exe" with commandline "shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-0 ..." (UID: 00000000-00003144) Spawned process "chrome.exe" (UID: 00000000-00008008) Spawned process "chrome.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Google\ ..." (UID: 00000000-00002740), Spawned process "chrome.exe" with commandline "--type=gpu-process --no-pre-read-main-dll --gpu-preferences=SAAA ..." (UID: 00000000-00002464), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00001636), Spawned process "chrome.exe" with commandline "--type=renderer --no-pre-read-main-dll --video-capture-use-gpu-m ..." (UID: 00000000-00006568), Spawned process "chrome.exe" with commandline "--type=renderer --no-pre-read-main-dll --video-capture-use-gpu-m ..." (UID: 00000000-00007740), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007412), Spawned process "chrome.exe" with commandline "--type=renderer --no-pre-read-main-dll --disable-gpu-compositing ..." (UID: 00000000-00004112), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics ..." (UID: 00000000-00006244), Spawned process "msedge.exe" (UID: 00000000-00002396), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00002436) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00008036) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007676) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007120) Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00001064) Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00002804) Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=patch.mojom.FilePatcher --lang ..." (UID: 00000000-00008092) Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00002128) Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00004952) Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00002608) Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001748) Spawned process "chrome.exe" with commandline "--type=renderer --extension-process --no-pre-read-main-dll --dis ..." (UID: 00000000-00005200) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00002380)3d:Tcf0,Spawned process "Dllhost.exe" (UID: 00000000-00001044) Spawned process "rundll32.exe" with commandline "shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-0 ..." (UID: 00000000-00003144) Spawned process "chrome.exe" (UID: 00000000-00008008) Spawned process "chrome.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Google\ ..." (UID: 00000000-00002740), Spawned process "chrome.exe" with commandline "--type=gpu-process --no-pre-read-main-dll --gpu-preferences=SAAA ..." (UID: 00000000-00002464), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00001636), Spawned process "chrome.exe" with commandline "--type=renderer --no-pre-read-main-dll --video-capture-use-gpu-m ..." (UID: 00000000-00006568), Spawned process "chrome.exe" with commandline "--type=renderer --no-pre-read-main-dll --video-capture-use-gpu-m ..." (UID: 00000000-00007740), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007412), Spawned process "chrome.exe" with commandline "--type=renderer --no-pre-read-main-dll --disable-gpu-compositing ..." (UID: 00000000-00004112), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics ..." (UID: 00000000-00006244), Spawned process "msedge.exe" (UID: 00000000-00002396), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00002436) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00008036) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007676) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007120) Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00001064) Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00002804) Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=patch.mojom.FilePatcher --lang ..." (UID: 00000000-00008092) Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00002128) Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00004952) Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00002608) Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001748) Spawned process "chrome.exe" with commandline "--type=renderer --extension-process --no-pre-read-main-dll --dis ..." (UID: 00000000-00005200) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00002380)3e:T84e,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: E8:F5:5F:48:81:CC:EC:8E:9A:08:0F:79:F8:9E:21:52:FF:3E:55:C6; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 6B:DD:9E:90:A1:B8:0E:F7:83:1D:3D:17:DB:A5:85:98:F2:E5:07:8C; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 95:51:3A:74:B2:D6:48:05:37:67:B4:98:88:41:81:F2:F0:9E:EC:4E; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 36:D5:2A:50:8C:E8:14:3D:3A:C7:62:5B:1D:B2:9E:66:95:40:EC:F0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 3F:A5:DB:F5:A0:B7:6B:D9:66:09:AC:39:9F:92:26:0A:AB:38:28:45; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: 27:E6:66:32:99:D3:40:DF:E5:45:71:CE:CC:EC:01:BE:74:49:5D:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information)3f:T58f,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "LA.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "LA.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "LA.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.6BF95000.00000002.mdmp, 00000000-00007100.00000001.226895.684F4000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp")40:T477,"LA.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "LA.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "LA.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "LA.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "LA.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "LA.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "LA.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "LA.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "LA.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "LA.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")41:T9a6,"LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "LA.EXE"; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "5EB60B36-6206-5538-E60A-0A7AF8A1E59D"; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "LA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")42:T4de,"LA.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "LA.exe" trying to touch file "C:\WINDOWS\SysWOW64\mpr.dll" "LA.exe" trying to touch file "C:\Windows\SysWOW64\mpr.dll" "LA.exe" trying to touch file "C:\LA.exe.Local\" "LA.exe" trying to touch file "C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\COMCTL32.dll" "LA.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\comctl32.dll" "LA.exe" trying to touch file "C:\WINDOWS\SysWOW64\version.dll" "LA.exe" trying to touch file "C:\Windows\SysWOW64\version.dll" "LA.exe" trying to touch file "C:\WINDOWS\SysWOW64\netapi32.dll" "LA.exe" trying to touch file "C:\Windows\SysWOW64\netapi32.dll" "LA.exe" trying to touch file "C:\winhttp.dll" "LA.exe" trying to touch file "C:\WINDOWS\SysWOW64\winhttp.dll" "LA.exe" trying to touch file "C:\Windows\SysWOW64\winhttp.dll" "LA.exe" trying to touch file "C:\WINDOWS\SysWOW64\NETUTILS.DLL" "LA.exe" trying to touch file "C:\Windows\SysWOW64\netutils.dll" "LA.exe" trying to touch file "C:\WINDOWS\SysWOW64\IMM32.DLL" "LA.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll"43:T8c8,"LA.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "LA.exe" trying to access non-existent file "C:\winhttp.dll" "LA.exe" trying to access non-existent file "C:\FLTLIB.DLL" "LA.exe" trying to access non-existent file "C:\MSVCP140.dll" "LA.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "LA.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "LA.exe" trying to access non-existent file "C:\SAMCLI.DLL" "Dllhost.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "Dllhost.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "Dllhost.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\wbem\wbemcomn.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\msedge_elf.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\dbghelp.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\dbghelp.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\WINMM.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\WINMM.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\FLTLIB.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\FLTLIB.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\MSVCP140.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\VCRUNTIME140.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\VCRUNTIME140_1.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\msvcp110_win.dll" "identity_helper.exe" trying to access non-existent file "C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\CFGMGR32.dll"44:Tb3a,"LA.exe" trying to access non-existent file "C:\LA.exe.Local\" "LA.exe" trying to access non-existent file "\Device\NamedPipe\UAPUVUNIQCIYYEBCSFLVS" "LA.exe" trying to access non-existent file "pipe\UAPUVUNIQCIYYEBCSFLVS" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\atomic" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Bitcoin" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Bitcoin" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Ledger Live" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\zmY8C0" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\zmY8C0\Default\u3meoLZp" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\zmY8C0\Default\Tl6fgXQbv" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\zmY8C0\Default\V2V6NKOh5" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\zmY8C0\Default\V2V6NKOh5\xJT7s6Dq0" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\zmY8C0\Default\V2V6NKOh5\XBms50" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\zmY8C0\Default\V2V6NKOh5\eIpR9kLpV6l0" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\Lwxjm15RsKF0" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\Lwxjm15RsKF0\Default\u3meoLZp" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\Lwxjm15RsKF0\Default\Tl6fgXQbv" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\Lwxjm15RsKF0\Default\V2V6NKOh5" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\Lwxjm15RsKF0\Default\V2V6NKOh5\xJT7s6Dq0" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\Lwxjm15RsKF0\Default\V2V6NKOh5\TUTYReh0" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\Lwxjm15RsKF0\Default\V2V6NKOh5\IbKV6Y5P0" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\Lwxjm15RsKF0\Default\V2V6NKOh5\XBms50" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\Lwxjm15RsKF0\Default\V2V6NKOh5\eIpR9kLpV6l0" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\jfZxM11" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\J1cH9sq\jfZxM11\lfdjd4n4.default"45:T490,Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; File: "LA.exe") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; File: "LA.exe") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; File: "LA.exe") Found reference to API "WNetGetUniversalNameW" (Indicator: "WNetGetUniversalName"; File: "LA.exe") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "LA.exe") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp") Found reference to API "WNetGetUniversalNameW" (Indicator: "WNetGetUniversalName"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp")46:T6e7,Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "LA.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "LA.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "LA.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "LA.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "LA.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "LA.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "LA.exe") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "LA.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "LA.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004004-00000C2C-2392054783") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004004-00000C2C-2392054924") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004004-00000C2C-2392055038") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp")47:T7ab,Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "LA.exe") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "LA.exe") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "LA.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "LA.exe") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "LA.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "LA.exe") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "LA.exe") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "LA.exe") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "LA.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "LA.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "LA.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "LA.exe") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; File: "LA.exe") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "LA.exe") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "LA.exe") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "LA.exe") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "LA.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "LA.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "LA.exe") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "LA.exe")48:T4f2,Found string "clientservices.googleapis.com" (Indicator: ".googleapis.com"; File: "PCAP") Found string "optimizationguide-pa.googleapis.com" (Indicator: ".googleapis.com"; File: "PCAP") Found string "safebrowsing.googleapis.com" (Indicator: ".googleapis.com"; File: "PCAP") Found string "storage.googleapis.com" (Indicator: ".googleapis.com"; File: "PCAP") Found string "+https://onedrive.live.com/windows/" (Indicator: "onedrive.live.com"; Source: "00000000-00007100.00000000.226397.DE674000.00000004.mdmp, 00000000-00007100.00000000.226397.DE689000.00000004.mdmp, 00000000-00007100.00000000.226397.DE6E9000.00000004.mdmp, 00000000-00007100.00000000.226397.E3B00000.00000004.mdmp, 00000000-00007100.00000000.226397.E3B13000.00000004.mdmp, 00000000-00007100.00000000.226397.E3B35000.00000004.mdmp, 00000000-00007100.00000001.226895.DE674000.00000004.mdmp, 00000000-00007100.00000001.226895.DE689000.00000004.mdmp, 00000000-00007100.00000001.226895.DE6E9000.00000004.mdmp, 00000000-00007100.00000001.226895.E3B00000.00000004.mdmp, 00000000-00007100.00000001.226895.E3B13000.00000004.mdmp, 00000000-00007100.00000001.226895.E3B24000.00000004.mdmp, 00000000-00007100.00000001.226895.E3B35000.00000004.mdmp, 00000000-00007100.00000001.226895.E3B46000.00000004.mdmp")49:T141b9,Found URL "https://www.microsoft.comtt" - Source: "00000000-00007100.00000000.226397.DE674000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00007100.00000000.226397.DE674000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00007100.00000000.226397.DE674000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00007100.00000000.226397.DE674000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00007100.00000000.226397.DE674000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00007100.00000000.226397.DE6E9000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00007100.00000000.226397.DE6E9000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00007100.00000000.226397.DE6E9000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00007100.00000000.226397.DE6E9000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00007100.00000000.226397.DE6E9000.00000004.mdmp") Found URL "https://www.microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.systemtrayglobal.systemtrayglobal.systemtrayassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.core_cw5n1h2txyewy!global.taskbarglobal.taskbarglobal.taskbarassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comv<<:6microsoftwindows.client.core_cw5n1h2txyewy!global.fileexplorerextensionsglobal.fileexplorerextensionsglobal.fileexplorerextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.snaplayoutglobal.snaplayoutglobal.snaplayoutassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxv" - Source: "00000000-00007100.00000000.226397.DE6E9000.00000004.mdmp") Found URL "http://microsoft.com@windows" - Source: "00000000-00007100.00000000.226397.DE6E9000.00000004.mdmp") Found URL "https://www.office.comthumbnail" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2093703https://go.microsoft.com/fwlink/?linkid=2348603sites" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://support.google.com/chromebook?p=app_intent" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2118167" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/en-us/privacystatementyou're" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://aka.ms/edgepreviewhttps://aka.ms/enterprisepreviewuserto" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2149872an" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2165400to" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2165278https://go.microsoft.com/fwlink/?linkid=2348701https://go.microsoft.com/fwlink/?linkid=2165325https://go.microsoft.com/fwlink/?linkid=2348900use" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2239343https://go.microsoft.com/fwlink/?linkid=2288290show" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2301855allow" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2149000browsing" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2194724ai-powered" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/microsoft-edge/microsoft-edge-browsing-activity-for-personalized-advertising-and-experiences-37aa831e-6372-238e-f33f-7cd3f0e53679allow" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/microsoft-365/family-safetyhttps://family.microsoft.com/?ref=edge://settings/familysafetyhttps://go.microsoft.com/fwlink/?linkid=2127630set" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/account-billing/view-device-and-app-use-with-family-safety-activity-reporting-b7b8501e-e35c-2224-bed8-115d5da4fbafto" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/account-billing/filter-websites-and-searches-using-microsoft-family-safety-3034d91e-5efa-9fbe-1384-46009f087ccfto" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://microsoftedgetips.microsoft.com/en-us/internet" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2211966writing" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://support.microsoft.com/office/microsoft-editor-checks-grammar-and-more-in-documents-mail-and-the-web-91ecbe1b-d021-4e9e-a82e-abc4cd7163d7are" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=521839microsoft" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2279846see" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2166676learn" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://easylist.to/easylist/easylist.txtthe" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://easylist.to/index.htmlallow" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2181135adds" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2161865alerts" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://aka.ms/techscam-detection-learn-moreblock" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=529732manage" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2105403this" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2114187https://go.microsoft.com/fwlink/?linkid=2077327edit" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2121003when" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/servicesagreementmanage" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2101140change" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://aka.ms/accountsecuritylearn" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://aka.ms/synclearnmorelinkprofile" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/deployedge/edge-learnmore-reset-data-in-cloudreset" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2333202save" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2167671use" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://example.comsuper" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2257424keep" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/edge/features/real-time-video-translation?form=ma13fj&ch=1show" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://microsoft.com/en-us/edge/ai-powered/copilot-mode?form=ma140nhttps://microsoft.com/en-us/edge/ai-powered/copilot-mode?form=ma140mcopilot" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337798https://go.microsoft.com/fwlink/?linkid=2337885explore" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337628https://go.microsoft.com/fwlink/?linkid=2345959explore" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337721https://go.microsoft.com/fwlink/?linkid=2345869discover" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addons" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addonsno" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://aka.ms/edgeprintingtroubleshooting" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://aka.ms/printtroubleshootingneed" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2126235if" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://www.bing.com/new/termsofuseenhanceenhance" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://www.microsoft.com/edge/copilot-mode?form=mg0awropen" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/copilot/privacy-and-protections" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/microsoft-365-copilot/microsoft-365-copilot-privacy" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://aka.ms/whatisscarewarequick" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2107360&clcid=0x409hi," - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "http://force" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2164373" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2164373the" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addons?hl=enhttps://www.whatsapp.comhttps://www.facebook.comhttps://www.youtube.comhttps://www.outlook.com/allow" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2151738learn" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "http://example.com" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://example.com.your" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://support.google.com/chrome/a/answer/9122284" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "http://.

" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "http://," - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "http://example.com." - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/p/?linkid=2114059" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/p/\?linkid=158334https://support.microsoft.com/en-us/windows/microsoft-edge-" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/topic/protect-your-online-accounts-using-password-monitor-6f660aae-65aa-476c-871a-7fe2bcb0c4c1let's" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2193240check" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/en-us/privacystatement" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2189718protected" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/privacystatementalways" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://m365.cloud.microsoft/chat?fromcode=cmm63o75lj0let's" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "http://microsoft.com/edge/surfintroducing" - Source: "00000000-00007100.00000000.226397.E18A0000.00000002.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00007100.00000000.226397.E3B00000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00007100.00000000.226397.E3B00000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00007100.00000000.226397.E3B00000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00007100.00000000.226397.E3B00000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00007100.00000000.226397.E3B00000.00000004.mdmp") Found URL "https://www.microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.systemtrayglobal.systemtrayglobal.systemtrayassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.core_cw5n1h2txyewy!global.taskbarglobal.taskbarglobal.taskbarassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comv<<:6microsoftwindows.client.core_cw5n1h2txyewy!global.fileexplorerextensionsglobal.fileexplorerextensionsglobal.fileexplorerextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.snaplayoutglobal.snaplayoutglobal.snaplayoutassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxv" - Source: "00000000-00007100.00000000.226397.E3B00000.00000004.mdmp") Found URL "http://microsoft.com@windows" - Source: "00000000-00007100.00000000.226397.E3B00000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00007100.00000000.226397.E3B13000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00007100.00000000.226397.E3B13000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00007100.00000000.226397.E3B13000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00007100.00000000.226397.E3B13000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00007100.00000000.226397.E3B13000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00007100.00000000.226397.E3B35000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00007100.00000000.226397.E3B35000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00007100.00000000.226397.E3B35000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00007100.00000000.226397.E3B35000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00007100.00000000.226397.E3B35000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00007100.00000001.226895.DE674000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00007100.00000001.226895.DE674000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00007100.00000001.226895.DE674000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00007100.00000001.226895.DE674000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00007100.00000001.226895.DE674000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00007100.00000001.226895.DE6E9000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00007100.00000001.226895.DE6E9000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00007100.00000001.226895.DE6E9000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00007100.00000001.226895.DE6E9000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00007100.00000001.226895.DE6E9000.00000004.mdmp") Found URL "https://www.microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.systemtrayglobal.systemtrayglobal.systemtrayassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.core_cw5n1h2txyewy!global.taskbarglobal.taskbarglobal.taskbarassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comv<<:6microsoftwindows.client.core_cw5n1h2txyewy!global.fileexplorerextensionsglobal.fileexplorerextensionsglobal.fileexplorerextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.snaplayoutglobal.snaplayoutglobal.snaplayoutassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxv" - Source: "00000000-00007100.00000001.226895.DE6E9000.00000004.mdmp") Found URL "http://microsoft.com@windows" - Source: "00000000-00007100.00000001.226895.DE6E9000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00007100.00000001.226895.E3B00000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00007100.00000001.226895.E3B00000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00007100.00000001.226895.E3B00000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00007100.00000001.226895.E3B00000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00007100.00000001.226895.E3B00000.00000004.mdmp") Found URL "https://www.microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.systemtrayglobal.systemtrayglobal.systemtrayassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.core_cw5n1h2txyewy!global.taskbarglobal.taskbarglobal.taskbarassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comv<<:6microsoftwindows.client.core_cw5n1h2txyewy!global.fileexplorerextensionsglobal.fileexplorerextensionsglobal.fileexplorerextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.snaplayoutglobal.snaplayoutglobal.snaplayoutassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxv" - Source: "00000000-00007100.00000001.226895.E3B00000.00000004.mdmp") Found URL "http://microsoft.com@windows" - Source: "00000000-00007100.00000001.226895.E3B00000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00007100.00000001.226895.E3B13000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00007100.00000001.226895.E3B13000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00007100.00000001.226895.E3B13000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00007100.00000001.226895.E3B13000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00007100.00000001.226895.E3B13000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00007100.00000001.226895.E3B24000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00007100.00000001.226895.E3B24000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00007100.00000001.226895.E3B24000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00007100.00000001.226895.E3B24000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00007100.00000001.226895.E3B24000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00007100.00000001.226895.E3B35000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00007100.00000001.226895.E3B35000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00007100.00000001.226895.E3B35000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00007100.00000001.226895.E3B35000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00007100.00000001.226895.E3B35000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00007100.00000001.226895.E3B46000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00007100.00000001.226895.E3B46000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00007100.00000001.226895.E3B46000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00007100.00000001.226895.E3B46000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00007100.00000001.226895.E3B46000.00000004.mdmp")4a:Tbf9,GET /async/folae?async=_fmt:pb HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQ Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /async/ddljson?async=ntp:2 HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQ Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQ X-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE= Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQ X-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE= Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /async/newtab_promos HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty 4b:T501f,Contains base62 string in header "IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmt" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "mqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2g" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "vkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80Z" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "zMPC8IKakv79jqU1UeFkizD8HSmWAxbTq" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "J9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI" in header "GET /async/folae?async=_fmt:pb HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmt" in header "GET /async/ddljson?async=ntp:2 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "mqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2g" in header "GET /async/ddljson?async=ntp:2 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "vkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80Z" in header "GET /async/ddljson?async=ntp:2 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j" in header "GET /async/ddljson?async=ntp:2 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "zMPC8IKakv79jqU1UeFkizD8HSmWAxbTq" in header "GET /async/ddljson?async=ntp:2 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "J9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI" in header "GET /async/ddljson?async=ntp:2 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLo" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmt" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "mqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2g" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "vkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80Z" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "zMPC8IKakv79jqU1UeFkizD8HSmWAxbTq" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "J9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "CKmdygEIveDKAQiTocsBCIWgzQE=Prior" in header "GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmt" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "mqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2g" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "vkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80Z" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "zMPC8IKakv79jqU1UeFkizD8HSmWAxbTq" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "J9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "CKmdygEIveDKAQiTocsBCIWgzQE=Prior" in header "GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2Host: www.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty"4c:T464,Short term registered certificate: "accounts.google.com" (83 days old) Short term registered certificate: "android.clients.google.com" (83 days old) Short term registered certificate: "chrome.google.com" (83 days old) Short term registered certificate: "clients1.google.com" (83 days old) Short term registered certificate: "clients2.google.com" (83 days old) Short term registered certificate: "clients2.googleusercontent.com" (83 days old) Short term registered certificate: "clientservices.googleapis.com" (83 days old) Short term registered certificate: "mtalk.google.com" (83 days old) Short term registered certificate: "ogads-pa.clients6.google.com" (83 days old) Short term registered certificate: "optimizationguide-pa.googleapis.com" (83 days old) Short term registered certificate: "play.google.com" (83 days old) Short term registered certificate: "safebrowsing.googleapis.com" (83 days old) Short term registered certificate: "storage.googleapis.com" (83 days old) Short term registered certificate: "www.google.com" (83 days old) Short term registered certificate: "www.gstatic.com" (83 days old)4d:T409,Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "LA.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "LA.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "LA.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "LA.exe") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "LA.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "LA.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "LA.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "LA.exe") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00004004.00000001.219138.006D6000.00000004.mdmp")4e:T5cf,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "LA.exe") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "LA.exe") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; File: "LA.exe") Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; File: "LA.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "::GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "::WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "NtQueryObject-type_info_length" (Indicator: "NtQueryObject"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp")4f:T5c3,Found string "TBase64Encoding&" (Indicator: "base64"; File: "LA.exe") Found string "TBase64EncodingXvd" (Indicator: "base64"; File: "LA.exe") Found string "invalid WinZip AES extra field" (Indicator: "aes"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found string "Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)" (Indicator: "aes"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found string "AES for Intel AES-NI, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found string "AES-NI GCM module for x86_64, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found string "ChaCha20 for x86_64, CRYPTOGAMS by " (Indicator: "chacha"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found string "SimdutfBase64Encode" (Indicator: "base64"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found string "AES_CBC_PKCS7" (Indicator: "aes"; Source: "00000000-00007100.00000000.226397.DE689000.00000004.mdmp, 00000000-00007100.00000001.226895.DE689000.00000004.mdmp")50:Tf52,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "LA.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "LA.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "LA.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.52711000.00000002.mdmp, 00000000-00007100.00000000.226397.6BF95000.00000002.mdmp, 00000000-00007100.00000001.226895.684F4000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.52711000.00000002.mdmp, 00000000-00007100.00000000.226397.6BF95000.00000002.mdmp, 00000000-00007100.00000001.226895.684F4000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.52711000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.52711000.00000002.mdmp, 00000000-00007100.00000001.226895.684F4000.00000002.mdmp") Found reference to API "__crtGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00007100.00000000.226397.52711000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00007100.00000000.226397.52711000.00000002.mdmp")51:T47e,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "LA.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.52711000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.52711000.00000002.mdmp, 00000000-00007100.00000001.226895.684F4000.00000002.mdmp")52:T1188,Found string "\Device\HarddiskVolume3\Windows\SysWOW64\dllhost.exe" (Indicator: "\Device\"; Source: "00000000-00004004-00000BC0-2406931236") Found string "\Device\HarddiskVolume3\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00003144.00000000.220668.749C0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003144.00000000.220668.749C0000.00000004.mdmp, 00000000-00003144.00000000.220668.74C20000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003144.00000000.220668.749C0000.00000004.mdmp, 00000000-00003144.00000000.220668.74C20000.00000004.mdmp") Found string "s\System32\Drivers\DriverDat" (Indicator: "\drivers\"; Source: "00000000-00004004.00000000.218037.00B70000.00000004.mdmp, 00000000-00004004.00000001.219138.00B70000.00000004.mdmp") Found string "s\System32\Drivers\DriverDat" (Indicator: "system32\drivers"; Source: "00000000-00004004.00000000.218037.00B70000.00000004.mdmp, 00000000-00004004.00000001.219138.00B70000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004004.00000000.218037.00B70000.00000004.mdmp, 00000000-00004004.00000000.218037.02690000.00000004.mdmp, 00000000-00004004.00000000.218037.02DD0000.00000004.mdmp, 00000000-00004004.00000001.219138.00A30000.00000004.mdmp, 00000000-00004004.00000001.219138.00B70000.00000004.mdmp, 00000000-00004004.00000001.219138.02690000.00000004.mdmp, 00000000-00004004.00000001.219138.02DD0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004004.00000000.218037.00B70000.00000004.mdmp, 00000000-00004004.00000000.218037.02690000.00000004.mdmp, 00000000-00004004.00000000.218037.02DD0000.00000004.mdmp, 00000000-00004004.00000001.219138.00A30000.00000004.mdmp, 00000000-00004004.00000001.219138.00B70000.00000004.mdmp, 00000000-00004004.00000001.219138.02690000.00000004.mdmp, 00000000-00004004.00000001.219138.02DD0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007100.00000000.226397.00054000.00000004.mdmp, 00000000-00007100.00000000.226397.DE613000.00000004.mdmp, 00000000-00007100.00000000.226397.DE6FA000.00000004.mdmp, 00000000-00007100.00000000.226397.E3B13000.00000004.mdmp, 00000000-00007100.00000000.226397.E3B35000.00000004.mdmp, 00000000-00007100.00000001.226895.00054000.00000004.mdmp, 00000000-00007100.00000001.226895.DE613000.00000004.mdmp, 00000000-00007100.00000001.226895.DE6FA000.00000004.mdmp, 00000000-00007100.00000001.226895.E3B13000.00000004.mdmp, 00000000-00007100.00000001.226895.E3B24000.00000004.mdmp, 00000000-00007100.00000001.226895.E3B35000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007100.00000000.226397.00054000.00000004.mdmp, 00000000-00007100.00000000.226397.DE613000.00000004.mdmp, 00000000-00007100.00000000.226397.DE6FA000.00000004.mdmp, 00000000-00007100.00000000.226397.E3B13000.00000004.mdmp, 00000000-00007100.00000000.226397.E3B35000.00000004.mdmp, 00000000-00007100.00000001.226895.00054000.00000004.mdmp, 00000000-00007100.00000001.226895.DE613000.00000004.mdmp, 00000000-00007100.00000001.226895.DE6FA000.00000004.mdmp, 00000000-00007100.00000001.226895.E3B13000.00000004.mdmp, 00000000-00007100.00000001.226895.E3B24000.00000004.mdmp, 00000000-00007100.00000001.226895.E3B35000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\msedge_elf.dll" (Indicator: "\Device\"; Source: "00000000-00007100.00000000.226397.DE613000.00000004.mdmp, 00000000-00007100.00000001.226895.DE613000.00000004.mdmp") Found string "C:\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007100.00000000.226397.DE689000.00000004.mdmp, 00000000-00007100.00000001.226895.DE689000.00000004.mdmp") Found string "\Device\HarddiskVolume4" (Indicator: "\Device\"; Source: "00000000-00007100.00000000.226397.DE689000.00000004.mdmp, 00000000-00007100.00000001.226895.DE689000.00000004.mdmp") Found string "\Device\Privacy" (Indicator: "\Device\"; Source: "00000000-00007100.00000000.226397.DE6FA000.00000004.mdmp, 00000000-00007100.00000001.226895.DE6FA000.00000004.mdmp")53:T627,Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp")54:Tf89,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "LA.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "LA.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "LA.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "LA.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "LA.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "LA.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "LA.exe") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "LA.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp")55:T57f,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "LA.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "LA.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.52711000.00000002.mdmp, 00000000-00007100.00000000.226397.6BF95000.00000002.mdmp, 00000000-00007100.00000001.226895.684F4000.00000002.mdmp")56:T4fe,Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; File: "LA.exe") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; File: "LA.exe") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "LA.exe") Found reference to API "procedure CreateMutex(const Name: String);" (Indicator: "CreateMutex"; File: "LA.exe") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00003144.00000000.220668.162C9000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00007100.00000000.226397.2FC01000.00000002.mdmp")57:T826,Found string "GetLogicalProcessorInformation" (Source: LA.exe, API is part of module: KERNELBASE.DLL) Found string "GetThreadPreferredUILanguages" (Source: LA.exe, API is part of module: KERNELBASE.DLL) Found string "SetThreadPreferredUILanguages" (Source: LA.exe, API is part of module: KERNELBASE.DLL) Found string "GetThreadUILanguage" (Source: LA.exe, API is part of module: KERNELBASE.DLL) Found string "GetLongPathNameW" (Source: LA.exe, API is part of module: KERNELBASE.DLL) Found string "VariantChangeTypeEx" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarNeg" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarNot" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarAdd" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarSub" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarMul" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarDiv" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarIdiv" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarMod" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarAnd" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarOr" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarXor" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarCmp" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarI4FromStr" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarR4FromStr" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarR8FromStr" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarDateFromStr" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarCyFromStr" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarBoolFromStr" (Source: LA.exe, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromCy" (Source: LA.exe, API is part of module: OLEAUT32.DLL)58:T513,TCP traffic to 142.251.218.142 on port 80 is sent without HTTP header TCP traffic to 142.251.218.67 on port 443 is sent without HTTP header TCP traffic to 142.251.218.238 on port 443 is sent without HTTP header TCP traffic to 142.251.156.119 on port 443 is sent without HTTP header TCP traffic to 142.250.31.84 on port 443 is sent without HTTP header UDP traffic to 142.251.156.119 on port 443 TCP traffic to 142.251.218.91 on port 443 is sent without HTTP header TCP traffic to 142.251.219.10 on port 443 is sent without HTTP header UDP traffic to 142.251.219.10 on port 443 TCP traffic to 142.251.219.142 on port 443 is sent without HTTP header UDP traffic to 142.251.219.142 on port 443 TCP traffic to 142.251.214.46 on port 443 is sent without HTTP header TCP traffic to 172.217.113.4 on port 443 is sent without HTTP header TCP traffic to 142.251.219.174 on port 443 is sent without HTTP header UDP traffic to 142.251.219.174 on port 443 UDP traffic to 172.217.113.4 on port 443 UDP traffic to 142.251.151.119 on port 443 TCP traffic to 142.251.218.142 on port 443 is sent without HTTP header TCP traffic to 142.251.214.42 on port 443 is sent without HTTP header TCP traffic to 142.251.218.78 on port 443 is sent without HTTP header UDP traffic to 142.251.218.78 on port 44359:T8ed,"LA.exe" wrote 000011C0 bytes to a remote process "C:\Windows\SysWOW64\dllhost.exe" (Handle: 720) "LA.exe" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\dllhost.exe" (Handle: 720) "LA.exe" wrote 00001000 bytes to a remote process "C:\Windows\SysWOW64\dllhost.exe" (Handle: 740) "LA.exe" wrote 00000018 bytes to a remote process "C:\Windows\SysWOW64\dllhost.exe" (Handle: 740) "LA.exe" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\dllhost.exe" (Handle: 740) "LA.exe" wrote 00000000 bytes to a remote process "C:\Windows\SysWOW64\dllhost.exe" (Handle: 740) "LA.exe" wrote 001BBC13 bytes to a remote process "C:\Windows\SysWOW64\dllhost.exe" (Handle: 740) "LA.exe" wrote 00000A70 bytes to a remote process "C:\Windows\SysWOW64\dllhost.exe" (Handle: 760) "LA.exe" wrote 00067000 bytes to a remote process "C:\Windows\SysWOW64\dllhost.exe" (Handle: 760) "LA.exe" wrote 00067000 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 800) "Dllhost.exe" wrote 00000400 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 1120) "Dllhost.exe" wrote 00000600 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 1120) "Dllhost.exe" wrote 00003400 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 1120) "Dllhost.exe" wrote 00000200 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 1120) "Dllhost.exe" wrote 00005000 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 1120) "Dllhost.exe" wrote 00000400 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 1244) "Dllhost.exe" wrote 00000600 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 1244) "Dllhost.exe" wrote 00003400 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 1244) "Dllhost.exe" wrote 00000200 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 1244) "Dllhost.exe" wrote 00005000 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 1244)5a:Tda3,"chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\discounts_db\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\GCM Store\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\AutofillAiModelCache\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Download Service\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\extensions_crx_cache\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Cache\No_Vary_Search\" "chrome.exe" trying to open a file "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\"5b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////9mZmZmZmZmZmb///////9mZ3iIiIdmZmZm//////93aIiIiIiIh3ZmZv/////3eIiIiIiIiHiIZmb/////d4iIiIiIiIiIiIZm////93iIiIiIiIiIiIiIZm//iHeIiIiIiIiIiIiIh4ZmiIh4iIiIiIiIiIiIiHd4ZoiHeIiIiIiIiIiIiIiHd3ZoiIiIiIiIiIiIiIiIiIdmaIiIj/////////iP///4ZmaIiIj///////+Ij///h+5miIiI////////iP//+I7uZoiIiI//////+I////iO7maIiIiI//+IiIiIj/+I7u5miPiIiP//iP//iP//h+7u5oiIiIiP//iP////+I7u7maIiIiIj//4j/////iI7u5miIiIiIj//4j///+IiI7uZoiIiIiI//+I///4iIiO7maIiIiIiI//+I//+IiIfu5miIiIiIiI//iI/4iIiHfnZoiIiIiIiP//iP+IiIh4hmiIiIiIiIiP/4iIiIiIiHZoiIj4iIiIj//4iIiIiIhmiIiIiIiIiIj//4iIiIiGZoiIiIiIiIiIiIiIiIiIdmiIiIiIiIiIiIiIiIiIh2aIiIiIiIiIiIiIiIiIiHZoiIiIiIiIiIiIiIiIiHZmiIiIiIiIiIh4iIiIiHZmiIiIiP//////d3d3d3dmZmZm////wAP//wAA//wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAADwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==5c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////9mZmZmZmZmZmb///////9mZ3iIiIdmZmZm//////93aIiIiIiIh3ZmZv/////3eIiIiIiIiHiIZmb/////d4iIiIiIiIiIiIZm////93iIiIiIiIiIiIiIZm//iHeIiIiIiIiIiIiIh4ZmiIh4iIiIiIiIiIiIiHd4ZoiHeIiIiIiIiIiIiIiHd3ZoiIiIiIiIiIiIiIiIiIdmaIiIj/////////iP///4ZmaIiIj///////+Ij///h+5miIiI////////iP//+I7uZoiIiI//////+I////iO7maIiIiI//+IiIiIj/+I7u5miPiIiP//iP//iP//h+7u5oiIiIiP//iP////+I7u7maIiIiIj//4j/////iI7u5miIiIiIj//4j///+IiI7uZoiIiIiI//+I///4iIiO7maIiIiIiI//+I//+IiIfu5miIiIiIiI//iI/4iIiHfnZoiIiIiIiP//iP+IiIh4hmiIiIiIiIiP/4iIiIiIiHZoiIj4iIiIj//4iIiIiIhmiIiIiIiIiIj//4iIiIiGZoiIiIiIiIiIiIiIiIiIdmiIiIiIiIiIiIiIiIiIh2aIiIiIiIiIiIiIiIiIiHZoiIiIiIiIiIiIiIiIiHZmiIiIiIiIiIh4iIiIiHZmiIiIiP//////d3d3d3dmZmZm////wAP//wAA//wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAADwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==5d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////9mZmZmZmZmZmb///////9mZ3iIiIdmZmZm//////93aIiIiIiIh3ZmZv/////3eIiIiIiIiHiIZmb/////d4iIiIiIiIiIiIZm////93iIiIiIiIiIiIiIZm//iHeIiIiIiIiIiIiIh4ZmiIh4iIiIiIiIiIiIiHd4ZoiHeIiIiIiIiIiIiIiHd3ZoiIiIiIiIiIiIiIiIiIdmaIiIj/////////iP///4ZmaIiIj///////+Ij///h+5miIiI////////iP//+I7uZoiIiI//////+I////iO7maIiIiI//+IiIiIj/+I7u5miPiIiP//iP//iP//h+7u5oiIiIiP//iP////+I7u7maIiIiIj//4j/////iI7u5miIiIiIj//4j///+IiI7uZoiIiIiI//+I///4iIiO7maIiIiIiI//+I//+IiIfu5miIiIiIiI//iI/4iIiHfnZoiIiIiIiP//iP+IiIh4hmiIiIiIiIiP/4iIiIiIiHZoiIj4iIiIj//4iIiIiIhmiIiIiIiIiIj//4iIiIiGZoiIiIiIiIiIiIiIiIiIdmiIiIiIiIiIiIiIiIiIh2aIiIiIiIiIiIiIiIiIiHZoiIiIiIiIiIiIiIiIiHZmiIiIiIiIiIh4iIiIiHZmiIiIiP//////d3d3d3dmZmZm////wAP//wAA//wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAADwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==5e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////9mZmZmZmZmZmb///////9mZ3iIiIdmZmZm//////93aIiIiIiIh3ZmZv/////3eIiIiIiIiHiIZmb/////d4iIiIiIiIiIiIZm////93iIiIiIiIiIiIiIZm//iHeIiIiIiIiIiIiIh4ZmiIh4iIiIiIiIiIiIiHd4ZoiHeIiIiIiIiIiIiIiHd3ZoiIiIiIiIiIiIiIiIiIdmaIiIj/////////iP///4ZmaIiIj///////+Ij///h+5miIiI////////iP//+I7uZoiIiI//////+I////iO7maIiIiI//+IiIiIj/+I7u5miPiIiP//iP//iP//h+7u5oiIiIiP//iP////+I7u7maIiIiIj//4j/////iI7u5miIiIiIj//4j///+IiI7uZoiIiIiI//+I///4iIiO7maIiIiIiI//+I//+IiIfu5miIiIiIiI//iI/4iIiHfnZoiIiIiIiP//iP+IiIh4hmiIiIiIiIiP/4iIiIiIiHZoiIj4iIiIj//4iIiIiIhmiIiIiIiIiIj//4iIiIiGZoiIiIiIiIiIiIiIiIiIdmiIiIiIiIiIiIiIiIiIh2aIiIiIiIiIiIiIiIiIiHZoiIiIiIiIiIiIiIiIiHZmiIiIiIiIiIh4iIiIiHZmiIiIiP//////d3d3d3dmZmZm////wAP//wAA//wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAADwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790267779139,"unified_at":"2026-09-24T16:36:19.139Z","metadata":{"hashes":{"sha256":"3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","sha1":"8370f9b88b4fe12cb1064ebd6ffa781434cdd29d","md5":"ba0ec19a36d0e08979ae38a2c8977a9c","sha512":"af8b9671c8248b44b404e253de83f7ad51b60130df515d9bfd1e4c7c5227466c5e4c0a3964e29f9505e436c8cc32566ac40f9a73a7031ff6456af405873dff30","ssdeep":"98304:fwSi0b67zeCzt0+yO3kSh1z3FSdueQjUJ7MJw55WuY8:CNR0k31MdtCuY8","ssdeep_chunks":["98304:fwSi0b6","98304:wSi0b67","98304:Si0b67z","98304:i0b67ze","98304:0b67zeC","98304:b67zeCz","98304:67zeCzt","98304:7zeCzt0","98304:zeCzt0+","98304:eCzt0+y","98304:Czt0+yO","98304:zt0+yO3","98304:t0+yO3k","98304:0+yO3kS","98304:+yO3kSh","98304:yO3kSh1","98304:O3kSh1z","98304:3kSh1z3","98304:kSh1z3F","98304:Sh1z3FS","98304:h1z3FSd","98304:1z3FSdu","98304:z3FSdue","98304:3FSdueQ","98304:FSdueQj","98304:SdueQjU","98304:dueQjUJ","98304:ueQjUJ7","98304:eQjUJ7M","98304:QjUJ7MJ","98304:jUJ7MJw","98304:UJ7MJw5","98304:J7MJw55","98304:7MJw55W","98304:MJw55Wu","98304:Jw55WuY","98304:w55WuY8","196608:fwSi0b6","196608:wSi0b67","196608:Si0b67z","196608:i0b67ze","196608:0b67zeC","196608:b67zeCz","196608:67zeCzt","196608:7zeCzt0","196608:zeCzt0+","196608:eCzt0+y","196608:Czt0+yO","196608:zt0+yO3","196608:t0+yO3k","196608:0+yO3kS","196608:+yO3kSh","196608:yO3kSh1","196608:O3kSh1z","196608:3kSh1z3","196608:kSh1z3F","196608:Sh1z3FS","196608:h1z3FSd","196608:1z3FSdu","196608:z3FSdue","196608:3FSdueQ","196608:FSdueQj","196608:SdueQjU","196608:dueQjUJ","196608:ueQjUJ7","196608:eQjUJ7M","196608:QjUJ7MJ","196608:jUJ7MJw","196608:UJ7MJw5","196608:J7MJw55","196608:7MJw55W","196608:MJw55Wu","196608:Jw55WuY","196608:w55WuY8","98304:CNR0k31","98304:NR0k31M","98304:R0k31Md","98304:0k31Mdt","98304:k31MdtC","98304:31MdtCu","98304:1MdtCuY","98304:MdtCuY8"],"imphash":"7c77b89cd344508d2ca812dd1c349c70"},"file_info":{"file_name":"LA.exe","file_type":["compressed","innosetup"],"file_type_id":"innosetup","file_size":5266192,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790230231000,"last_seen":1790239206000,"last_multi_scan":1790239206000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":23},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":94},"sandbox_signatures":{"informative_count":213,"suspicious_count":15,"malicious_count":7,"total":235},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware_","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"suspicious","value":"References bcrypt module and functions (used for encryption/decryption)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"malicious","value":"Contacts multiple hosts"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"},{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"suspicious","value":"Detected dllhost.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Able to manipulate a file/directory time format"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","identifiers":[{"type":"suspicious","value":"Detected system process execution without parameters (likely process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"malicious","value":"Detected Rundll32 process execution"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Contains ability to hook/unhook windows functions"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"malicious","value":"Detected multiple DNS responses with a low TTL"},{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains registry location strings","description":"$22","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$23","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"MoveFileEx\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"MoveFileEx failed (%d).\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteEx\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"ShellExecuteEx failed (%d).\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"ShellExecuteEx returned hProcess=0\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess failed (%d).\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-146","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyEx\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExA\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"ISCryptGetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\"), Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-908","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-324","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetNativeSystemInfo\" in \"sample.bin\", Found system information discovery API: \"GetMonitorInfoA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-663","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\"), Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" (Indicator: \"software\\microsoft\\windows\\currentversion\\runonce\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyEx\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"$Credential without user and password+Platform-dependant function not implemented)Scheme-dependant function not implemented\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-437","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetCurrentDirectory\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"command.com\", Pattern match: \"https://www.innosetup.com/\", Pattern match: \"https://light-alloy.com\", Pattern match: \"https://www.remobjects.com/ps\", Pattern match: \"http://direct:80\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.innosetup.com\", Found HTTPS url \"https://light\", Found HTTPS url \"https://www.remobjects.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.0\" (Indicator: \"HTTP/1.0\"; Source: \"sample.bin\"), Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-457","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"User chose not to shutdown applications using our files.\" (Indicator: \" shutdown \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"sample.bin\"), Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070","id":"string-553","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$24","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"LA.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"LA.exe\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003144.00000000.220668.162C9000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"LA.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$27","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"LA.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00007100.00000000.226397.52711000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA512 block transform for x86_64, CRYPTOGAMS by \" (Indicator: \"SHA512\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")\n Found reference to \"Windows.Security.Cryptography.Core.HashAlgorithmNameses\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00007100.00000000.226397.DE689000.00000004.mdmp, 00000000-00007100.00000001.226895.DE689000.00000004.mdmp\")\n Found reference to \"Windows.Security.Cryptography.Core.HashAlgorithmProvider\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00007100.00000000.226397.DE689000.00000004.mdmp, 00000000-00007100.00000001.226895.DE689000.00000004.mdmp\")\n Found reference to \"Windows.Security.Cryptography.Core.HashAlgorithmNames\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00007100.00000000.226397.DE689000.00000004.mdmp, 00000000-00007100.00000001.226895.DE689000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004004.00000001.219138.02B20000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\pipe\\UAPUVUNIQCIYYEBCSFLVS; Source: \"00000000-00004004.00000001.219138.00B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 6DB70000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"LA.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"LA.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"Dllhost.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Dllhost.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor al\n 98h in Stream UID: 30887-2874-004146A8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00003144.00000000.220668.749C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\System32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003144.00000000.220668.749C0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004004.00000000.218037.00B70000.00000004.mdmp, 00000000-00004004.00000001.219138.00B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2c","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.34255","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: References bcrypt module and functions (used for encryption/decryption)\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match – Encryption algorithm","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"LA.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"LA.exe\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResourceW\"; File: \"LA.exe\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResourceW\"; Source: \"00000000-00004004.00000001.219138.006D6000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003144.00000000.220668.162C9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003144.00000000.220668.162C9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"LA.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"LA.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003144.00000000.220668.162C9000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to manipulate a file/directory time format","description":"Found string \".?AVSimpleDateFormat@icu_77@@\" (Indicator: \"simpledateformat\"; Source: \"00000000-00007100.00000000.226397.2E88E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-778","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"LA.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"LA.exe\")\n Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"LA.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"LA.exe\" called \"RtlDecompressBuffer\" with parameters (UID: 00000000-00004004)\n \"LA.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004004)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"LA.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004004)\n \"LA.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00004004)\n \"LA.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00004004)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"LA.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004004)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"LA.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004004)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"LA.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004004)\n \"identity_helper.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007100)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDrives@kernel32.dll at 30887-3127-00413FEE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"LA.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"LA.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@kernel32.dll at 30887-1957-00414146","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@kernel32.dll at 30887-1811-0040D7CE\n GetVersion@kernel32.dll at 30887-1812-004052BC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"LA.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"LA.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"identity_helper.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve configuration of a workstation (API string)","description":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; File: \"LA.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-451","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@kernel32.dll at 30887-1881-004052C4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"LA.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"LA.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004004.00000001.219138.006D6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"LA.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"LA.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@kernel32.dll directly followed by \"cmp byte ptr [006D0C10h], 00h\" and \"je 0040DA7Ah\" at 30887-1811-0040D7CE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"LA.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Dllhost.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00001044-00000C17-2426490784\n \"Dllhost.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00001044-00000C17-2426612660\n \"Dllhost.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00001044-00000C17-2426906847\n \"Dllhost.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies\" at 00000000-00001044-00000C17-2445893079\n \"Dllhost.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies\" at 00000000-00001044-00000C17-2460387643","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"LA.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"LA.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"LA.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003144.00000000.220668.162C9000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"LA.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\SysWOW64\\Dllhost.exe\" - (UID: 00000000-00004004)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$34","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.google.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"162.219.30.165:3333\"\n \"162.219.30.165:3334\"\n \"142.251.218.142:80\"\n \"142.251.218.67:443\"\n \"142.251.218.238:443\"\n \"142.251.156.119:443\"\n \"142.250.31.84:443\"\n \"142.251.218.91:443\"\n \"142.251.219.10:443\"\n \"142.251.219.142:443\"\n \"142.251.214.46:443\"\n \"172.217.113.4:443\"\n \"142.250.141.188:5228\"\n \"142.251.219.174:443\"\n \"3.171.117.127:443\"\n \"142.251.151.119:443\"\n \"142.251.151.119\"\n \"142.251.218.225:443\"\n \"23.61.246.219:443\"\n \"142.251.218.142:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"LA.exe\")\n Found reference to API \"CreateDirectoryAndGetError\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.52711000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"LA.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"MsgWaitForMultipleObjectsEx at 30887-2470-00414B36","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"LA.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@kernel32.dll at 30887-3203-00410BF1\n LoadLibraryA@kernel32.dll at 30887-3209-004105C4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"LA.exe\")\n Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; File: \"LA.exe\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"LA.exe\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"LA.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"LA.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"LA.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"LA.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003144.00000000.220668.162C9000.00000002.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"LA.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"LA.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004004.00000001.219138.006D6000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00004004.00000001.219138.006D6000.00000004.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$37","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"\n Pattern match: \"r@uma.negativesamples.reason\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$38","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"$39","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"Dllhost.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 74920000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"LA.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 74750000\n \"Dllhost.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 74B40000\n \"Dllhost.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 758F0000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 78330000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 772B0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"LA.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76B90000\n \"Dllhost.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76B90000\n \"rundll32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 79380000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 79380000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00000000002042f877fb7f0000@ntdll.dll\"\n \"22002300000000004042f877fb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"LA.exe\" was detected as \"Embarcadero Delphi\" and name: \"Compiler\"\n \"LA.exe\" was detected as \"Turbo Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"identity_helper.exe\" touched \"Windows Push Notification Developer Proxy Stub\" (Path: \"HKCU\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}\\TREATAS\")\n \"identity_helper.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"identity_helper.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\\TREATAS\")\n \"identity_helper.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")\n \"identity_helper.exe\" touched \"Property System Apartment Class Factory\" (Path: \"HKCU\\CLSID\\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}\\TREATAS\")\n \"identity_helper.exe\" touched \"ShellItem Shell Namespace helper\" (Path: \"HKCU\\CLSID\\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\\TREATAS\")\n \"identity_helper.exe\" touched \"Windows Search Manager\" (Path: \"HKCU\\CLSID\\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\dllhost.exe\" [Source: 00000000-00004004-00000BC0-2406931236]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\Dllhost.exe\" [Source: 00000000-00004004-00000BC0-2406935500]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"accounts.google.com\"\n \"android.clients.google.com\"\n \"chrome.google.com\"\n \"clients1.google.com\"\n \"clients2.google.com\"\n \"clients2.googleusercontent.com\"\n \"clientservices.googleapis.com\"\n \"edge-consumer-static.azureedge.net\"\n \"mtalk.google.com\"\n \"ogads-pa.clients6.google.com\"\n \"optimizationguide-pa.googleapis.com\"\n \"play.google.com\"\n \"safebrowsing.googleapis.com\"\n \"sb.scorecardresearch.com\"\n \"storage.googleapis.com\"\n \"www.google.com\"\n \"www.gstatic.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"LA.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"LA.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"LA.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"LA.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$3d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$3e","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"LA.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"LA.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"Dllhost.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"LA.exe\" queries basic process information of the \"C:\\LA.exe\" (UID: 4004)\n \"LA.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\dllhost.exe\" (UID: 4004)\n \"Dllhost.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\dllhost.exe\" (UID: 1044)\n \"Dllhost.exe\" queries basic process information of the \"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (UID: 1044)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\System32\\rundll32.exe\" (UID: 3144)\n \"identity_helper.exe\" queries basic process information of the \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe\" (UID: 7100)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Makes a code branch decision directly after an API that is environment aware\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"LA.exe\" writes file \"\\device\\namedpipe\\uapuvuniqciyyebcsflvs\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /async/folae?async=_fmt:pb\"\n Found http requests in header \"GET /async/ddljson?async=ntp:2\"\n Found http requests in header \"GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE\"\n Found http requests in header \"GET /async/newtab_ogb?hl=en-US&async=fixed:0\"\n Found http requests in header \"GET /async/newtab_promos\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"LA.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; File: \"LA.exe\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"LA.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"LA.exe\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00004004.00000001.219138.006D6000.00000004.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004004.00000001.219138.006D6000.00000004.mdmp\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00004004.00000001.219138.006D6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 142.251.218.142 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"0.0.0.0\" found in string \"0.0.0.0-devel\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$49","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$4a","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$4b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"android.clients.google.com\" has high entropy\n Contacted domain: \"clients2.googleusercontent.com\" has high entropy\n Contacted domain: \"clientservices.googleapis.com\" has high entropy\n Contacted domain: \"ogads-pa.clients6.google.com\" has high entropy\n Contacted domain: \"safebrowsing.googleapis.com\" has high entropy\n Contacted domain: \"storage.googleapis.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7\n Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"accounts.google.com\" (13 days old)\n Newly renewed or created SSL certificate: \"mtalk.google.com\" (13 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://direct:80\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://www.google.com/async/folae?async=_fmt:pb\n Found HTTPS GET request to https://www.google.com/async/ddljson?async=ntp:2\n Found HTTPS GET request to https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE\n Found HTTPS GET request to https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0\n Found HTTPS GET request to https://www.google.com/async/newtab_promos","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"$4c","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"142.251.218.67\" on port \"443\"\n HTTPS traffic to \"142.251.218.238\" on port \"443\"\n HTTPS traffic to \"142.251.156.119\" on port \"443\"\n HTTPS traffic to \"142.250.31.84\" on port \"443\"\n HTTPS traffic to \"142.251.218.91\" on port \"443\"\n HTTPS traffic to \"142.251.219.10\" on port \"443\"\n HTTPS traffic to \"142.251.219.142\" on port \"443\"\n HTTPS traffic to \"142.251.214.46\" on port \"443\"\n HTTPS traffic to \"172.217.113.4\" on port \"443\"\n HTTPS traffic to \"142.251.219.174\" on port \"443\"\n HTTPS traffic to \"3.171.117.127\" on port \"443\"\n HTTPS traffic to \"142.251.151.119\" on port \"443\"\n HTTPS traffic to \"142.251.218.225\" on port \"443\"\n HTTPS traffic to \"23.61.246.219\" on port \"443\"\n HTTPS traffic to \"142.251.218.142\" on port \"443\"\n HTTPS traffic to \"142.251.214.42\" on port \"443\"\n HTTPS traffic to \"142.251.218.78\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00004004\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on process \"00000000-00004004\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"::WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"F+ncalrpc:[OLEF387554DCA772B0A833932D732E9]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007100.00000000.226397.DE674000.00000004.mdmp, 00000000-00007100.00000000.226397.DE689000.00000004.mdmp, 00000000-00007100.00000000.226397.DE6FA000.00000004.mdmp, 00000000-00007100.00000001.226895.DE674000.00000004.mdmp, 00000000-00007100.00000001.226895.DE689000.00000004.mdmp, 00000000-00007100.00000001.226895.DE6FA000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEC1D962E14749AEEB970964DE8E04]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007100.00000000.226397.DE674000.00000004.mdmp, 00000000-00007100.00000000.226397.DE689000.00000004.mdmp, 00000000-00007100.00000001.226895.DE674000.00000004.mdmp, 00000000-00007100.00000001.226895.DE689000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE37E09745664A8D35F174084FCF84]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007100.00000000.226397.DE689000.00000004.mdmp, 00000000-00007100.00000001.226895.DE689000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"file/memory contains long string with (Indicator: \"--user-data-dir\"; File: \"chrome.exe\")\n Found string \"--user-data-dir=\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"LA.exe\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"LA.exe\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"LA.exe\")\n Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; File: \"LA.exe\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00004004.00000001.219138.006D6000.00000004.mdmp\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00004004.00000001.219138.006D6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"LA.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"LA.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"LA.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 74910000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"LA.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"LA.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"identity_helper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"identity_helper.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"LA.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"LA.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.52711000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.52711000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExFromAppW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")\n Found reference to API \"FindFirstFileEx\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"LA.exe\")\n Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00004004.00000001.219138.006D6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"LA.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003144.00000000.220668.162C9000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"LA.exe\")\n Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; File: \"LA.exe\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"LA.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000001.226895.684F4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"LA.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"LA.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004004.00000001.219138.006D6000.00000004.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$52","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"LA.exe\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"LA.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"LA.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00004004.00000001.219138.006D6000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00004004.00000001.219138.006D6000.00000004.mdmp\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00004004.00000001.219138.006D6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"LA.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00007100.00000000.226397.2FC01000.00000002.mdmp, 00000000-00007100.00000000.226397.52711000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"LA.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00007100.00000000.226397.000BC000.00000004.mdmp\n 00000000-00007100.00000000.226397.02E50000.00000002.mdmp\n 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"LA.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004004.00000000.218037.02B20000.00000040.mdmp, 00000000-00004004.00000001.219138.02B20000.00000040.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"LA.exe\" opened \"\\Device\\KsecDD\"\n \"Dllhost.exe\" opened \"\\Device\\KsecDD\"\n \"chrome.exe\" opened \"\\Device\\KsecDD\"\n \"msedge.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"LA.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSWOW64\\DLLHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"LA.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"LA.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00004004.00000001.219138.006D6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"LA.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\SysWOW64\\Dllhost.exe\" launched with commandline \"\" (UID: 00000000-00001044)\n Process \"%WINDIR%\\System32\\rundll32.exe\" launched with commandline \"shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding\" (UID: 00000000-00003144)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00007100.00000000.226397.02E50000.00000002.mdmp, 00000000-00007100.00000000.226397.2FC01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"suspicious","category":"Cryptographic Related","name":"References bcrypt module and functions (used for encryption/decryption)","description":"Found AES encryption functions \"['BCryptOpenAlgorithmProvider', 'BCryptCloseAlgorithmProvider', 'BCryptGenRandom', 'bcrypt.dll']\" - Source: \"00000000-00004004.00000000.218037.02B20000.00000040.mdmp\")\n Found AES encryption functions \"['BCryptOpenAlgorithmProvider', 'BCryptCloseAlgorithmProvider', 'BCryptGenRandom', 'bcrypt.dll']\" - Source: \"00000000-00004004.00000001.219138.02B20000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1573","relevance":5,"id":"memorydump-14","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/23 Antivirus vendors marked sample as malicious (4% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FreeResource@kernel32.dll at 30887-1963-00413F36","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 142.251.156.119\"\n \"UDP connection to 142.251.219.10\"\n \"UDP connection to 142.251.219.142\"\n \"UDP connection to 142.251.219.174\"\n \"UDP connection to 172.217.113.4\"\n \"UDP connection to 142.251.151.119\"\n \"UDP connection to 142.251.218.78\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"$58","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"LA.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00004004)\n \"LA.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00004004)\n \"LA.exe\" called \"Process32NextW with parameter Registry\" (UID: 00000000-00004004)\n \"LA.exe\" called \"Process32NextW with parameter smss.exe\" (UID: 00000000-00004004)\n \"LA.exe\" called \"Process32NextW with parameter csrss.exe\" (UID: 00000000-00004004)\n \"LA.exe\" called \"Process32NextW with parameter wininit.exe\" (UID: 00000000-00004004)\n \"LA.exe\" called \"Process32NextW with parameter winlogon.exe\" (UID: 00000000-00004004)\n \"LA.exe\" called \"Process32NextW with parameter services.exe\" (UID: 00000000-00004004)\n \"LA.exe\" called \"Process32NextW with parameter lsass.exe\" (UID: 00000000-00004004)\n \"LA.exe\" called \"Process32NextW with parameter svchost.exe\" (UID: 00000000-00004004)\n \"LA.exe\" called \"Process32NextW with parameter fontdrvhost.exe\" (UID: 00000000-00004004)\n \"LA.exe\" called \"Process32NextW with parameter dwm.exe\" (UID: 00000000-00004004)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to hook/unhook windows functions","description":"SetWindowsHookExW@user32.dll at 30887-2507-00414CC0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":5,"id":"stream-107","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"suspicious","category":"System Security","name":"Detected dllhost.exe process execution","description":"Process \"Dllhost.exe\"","origin":"Monitored Target","mitre_attack_id":"T1548.002","relevance":10,"id":"target-499","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"LA.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Detected system process execution without parameters (likely process injection)","description":"Process \"Dllhost.exe\" with commandline \"\" [UID: 00000000-00001044]","origin":"Monitored Target","mitre_attack_id":"T1218","relevance":7,"id":"target-503","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%WINDIR%\\SysWOW64\\Dllhost.exe\" spawned likely due to injection\n Process \"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe\" spawned likely due to injection\n Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawns a process via DCOM","description":"Process \"rundll32.exe\" with commandline \"shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding\" (UID: 00000000-00003144) was spawned by \"C:\\WINDOWS\\system32\\svchost.exe -k DcomLaunch -p\"","origin":"Monitored Target","relevance":10,"id":"target-104","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"LA.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\SysWOW64\\Dllhost.exe\" - (UID: 00000000-00004004)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Detected Rundll32 process execution","description":"Process \"rundll32.exe\" with commandline \"shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding\" (UID: 00000000-00003144)","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":10,"id":"target-115","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"Dllhost.exe\" at 00000000-00001044-00000C15-2426490906\n \"Dllhost.exe\" at 00000000-00001044-00000C15-2426494537","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$59","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"malicious","category":"Network Related","name":"Contacts multiple hosts","description":"Contacted 25 (or more) hosts in at least 0 different cls.countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"malicious","category":"Network Related","name":"Detected multiple DNS responses with a low TTL","description":"\"accounts.google.com\" with TTL 140\n \"android.clients.google.com\" with TTL 1\n \"chrome.google.com\" with TTL 300\n \"clients1.google.com\" with TTL 57\n \"clients2.google.com\" with TTL 46\n \"clients2.googleusercontent.com\" with TTL 300\n \"clientservices.googleapis.com\" with TTL 149\n \"mtalk.google.com\" with TTL 202\n \"ogads-pa.clients6.google.com\" with TTL 94\n \"optimizationguide-pa.googleapis.com\" with TTL 300\n \"play.google.com\" with TTL 55\n \"safebrowsing.googleapis.com\" with TTL 300\n \"sb.scorecardresearch.com\" with TTL 60\n \"storage.googleapis.com\" with TTL 300\n \"www.google.com\" with TTL 140\n \"www.gstatic.com\" with TTL 229","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$5a","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected multiple DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 17 domains and 17 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]}],"intel_graph":{"map":{"Domain:accounts.google.com":{"type":"Domain","value":"accounts.google.com"},"Domain:android.clients.google.com":{"type":"Domain","value":"android.clients.google.com"},"Domain:chrome.google.com":{"type":"Domain","value":"chrome.google.com"},"Domain:clients1.google.com":{"type":"Domain","value":"clients1.google.com"},"Domain:clients2.google.com":{"type":"Domain","value":"clients2.google.com"},"Domain:clients2.googleusercontent.com":{"type":"Domain","value":"clients2.googleusercontent.com"},"Domain:clientservices.googleapis.com":{"type":"Domain","value":"clientservices.googleapis.com"},"Domain:edge-consumer-static.azureedge.net":{"type":"Domain","value":"edge-consumer-static.azureedge.net"},"Domain:mtalk.google.com":{"type":"Domain","value":"mtalk.google.com"},"Domain:ogads-pa.clients6.google.com":{"type":"Domain","value":"ogads-pa.clients6.google.com"},"Domain:optimizationguide-pa.googleapis.com":{"type":"Domain","value":"optimizationguide-pa.googleapis.com"},"Domain:play.google.com":{"type":"Domain","value":"play.google.com"},"Domain:safebrowsing.googleapis.com":{"type":"Domain","value":"safebrowsing.googleapis.com"},"Domain:sb.scorecardresearch.com":{"type":"Domain","value":"sb.scorecardresearch.com"},"Domain:storage.googleapis.com":{"type":"Domain","value":"storage.googleapis.com"},"Domain:www.google.com":{"type":"Domain","value":"www.google.com"},"Domain:www.gstatic.com":{"type":"Domain","value":"www.gstatic.com"},"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3":{"type":"File","value":"3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3"},"Ip:142.250.141.188":{"type":"Ip","value":"142.250.141.188"},"Ip:142.250.31.84":{"type":"Ip","value":"142.250.31.84"},"Ip:142.251.151.119":{"type":"Ip","value":"142.251.151.119"},"Ip:142.251.156.119":{"type":"Ip","value":"142.251.156.119"},"Ip:142.251.214.42":{"type":"Ip","value":"142.251.214.42"},"Ip:142.251.214.46":{"type":"Ip","value":"142.251.214.46"},"Ip:142.251.218.142":{"type":"Ip","value":"142.251.218.142"},"Ip:142.251.218.225":{"type":"Ip","value":"142.251.218.225"},"Ip:142.251.218.238":{"type":"Ip","value":"142.251.218.238"},"Ip:142.251.218.67":{"type":"Ip","value":"142.251.218.67"},"Ip:142.251.218.78":{"type":"Ip","value":"142.251.218.78"},"Ip:142.251.218.91":{"type":"Ip","value":"142.251.218.91"},"Ip:142.251.219.10":{"type":"Ip","value":"142.251.219.10"},"Ip:142.251.219.14":{"type":"Ip","value":"142.251.219.14"},"Ip:142.251.219.142":{"type":"Ip","value":"142.251.219.142"},"Ip:142.251.219.174":{"type":"Ip","value":"142.251.219.174"},"Ip:150.171.109.74":{"type":"Ip","value":"150.171.109.74"},"Ip:162.219.30.165":{"type":"Ip","value":"162.219.30.165"},"Ip:172.217.113.4":{"type":"Ip","value":"172.217.113.4"},"Ip:23.61.246.219":{"type":"Ip","value":"23.61.246.219"},"Ip:3.171.117.127":{"type":"Ip","value":"3.171.117.127"},"Url:/async/ddljson?async=ntp:2":{"type":"Url","value":"/async/ddljson?async=ntp:2"},"Url:/async/folae?async=_fmt:pb":{"type":"Url","value":"/async/folae?async=_fmt:pb"},"Url:/async/newtab_ogb?hl=en-US&async=fixed:0":{"type":"Url","value":"/async/newtab_ogb?hl=en-US&async=fixed:0"},"Url:/async/newtab_promos":{"type":"Url","value":"/async/newtab_promos"},"Url:/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE":{"type":"Url","value":"/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE"}},"chains":[{"id":"sandbox_network","root":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","edges":[{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:162.219.30.165"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:162.219.30.165"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.251.218.142"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.251.218.67"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.251.218.238"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.251.156.119"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.250.31.84"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.251.218.91"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.251.219.10"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.251.219.142"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.251.214.46"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:172.217.113.4"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.250.141.188"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.251.219.174"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:3.171.117.127"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.251.151.119"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.251.151.119"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.251.218.225"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:23.61.246.219"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.251.218.142"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.251.214.42"},{"edge_kind":"contacted_ip","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Ip:142.251.218.78"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:accounts.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:accounts.google.com","to_key":"Ip:142.250.31.84"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:android.clients.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:android.clients.google.com","to_key":"Ip:142.251.219.14"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:chrome.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:chrome.google.com","to_key":"Ip:142.251.214.46"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:clients1.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients1.google.com","to_key":"Ip:142.251.218.142"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:clients2.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.google.com","to_key":"Ip:142.251.218.142"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:clients2.googleusercontent.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.googleusercontent.com","to_key":"Ip:142.251.218.225"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:clientservices.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:clientservices.googleapis.com","to_key":"Ip:142.251.218.238"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:edge-consumer-static.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edge-consumer-static.azureedge.net","to_key":"Ip:150.171.109.74"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:mtalk.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:mtalk.google.com","to_key":"Ip:142.250.141.188"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:ogads-pa.clients6.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:ogads-pa.clients6.google.com","to_key":"Ip:142.251.219.10"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:optimizationguide-pa.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:optimizationguide-pa.googleapis.com","to_key":"Ip:172.217.113.4"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:play.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:play.google.com","to_key":"Ip:142.251.219.142"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:safebrowsing.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:safebrowsing.googleapis.com","to_key":"Ip:142.251.214.42"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:sb.scorecardresearch.com"},{"edge_kind":"resolves_to","from_key":"Domain:sb.scorecardresearch.com","to_key":"Ip:3.171.117.127"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:storage.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:storage.googleapis.com","to_key":"Ip:142.251.218.91"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:www.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.google.com","to_key":"Ip:142.251.156.119"},{"edge_kind":"contacted_domain","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Domain:www.gstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.gstatic.com","to_key":"Ip:142.251.218.67"},{"edge_kind":"contacted_url","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Url:/async/folae?async=_fmt:pb"},{"edge_kind":"contacted_url","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Url:/async/ddljson?async=ntp:2"},{"edge_kind":"contacted_url","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Url:/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE"},{"edge_kind":"contacted_url","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Url:/async/newtab_ogb?hl=en-US&async=fixed:0"},{"edge_kind":"contacted_url","from_key":"File:3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","to_key":"Url:/async/newtab_promos"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":37,"spawned_processes_count":37,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":227,"imported_dlls_count":233,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":54,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":22,"dns_resolutions_count":17,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"6ab4e1e61894208a06045ea6","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Malware_","contacted_countries":["GBR","USA"],"submit_name":"LA.exe","analysis_start_time":"2026-09-24T08:40:07+00:00","indicators_count":{"informative":211,"suspicious":33,"malicious":9},"tags":["Multi-Process","Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"162.219.30.165","port":3333,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"162.219.30.165","port":3334,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.251.218.142","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.251.218.67","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.251.218.238","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.251.156.119","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.250.31.84","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.251.218.91","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.251.219.10","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.251.219.142","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.251.214.46","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"172.217.113.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.250.141.188","port":5228,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.251.219.174","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"3.171.117.127","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.251.151.119","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.251.151.119","port":0,"protocol":"ICMP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.251.218.225","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"23.61.246.219","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.251.218.142","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.251.214.42","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"address":"142.251.218.78","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]}],"dns_resolutions":[{"domain":"accounts.google.com","address":"142.250.31.84","ttl":140,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"domain":"android.clients.google.com","address":"142.251.219.14","ttl":1,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"domain":"chrome.google.com","address":"142.251.214.46","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"domain":"clients1.google.com","address":"142.251.218.142","ttl":57,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"domain":"clients2.google.com","address":"142.251.218.142","ttl":46,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"domain":"clients2.googleusercontent.com","address":"142.251.218.225","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"domain":"clientservices.googleapis.com","address":"142.251.218.238","ttl":149,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"domain":"edge-consumer-static.azureedge.net","address":"150.171.109.74","ttl":732,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"domain":"mtalk.google.com","address":"142.250.141.188","ttl":202,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"domain":"ogads-pa.clients6.google.com","address":"142.251.219.10","ttl":94,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"domain":"optimizationguide-pa.googleapis.com","address":"172.217.113.4","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"domain":"play.google.com","address":"142.251.219.142","ttl":55,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"domain":"safebrowsing.googleapis.com","address":"142.251.214.42","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"domain":"sb.scorecardresearch.com","address":"3.171.117.127","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"domain":"storage.googleapis.com","address":"142.251.218.91","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"domain":"www.google.com","address":"142.251.156.119","ttl":140,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"domain":"www.gstatic.com","address":"142.251.218.67","ttl":229,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]}],"http_requests":[{"host":"www.google.com","host_ip":"142.251.156.119:443","url":"/async/folae?async=_fmt:pb","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /async/folae?async=_fmt:pb HTTP/2\nHost: www.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nCookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQ\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"host":"www.google.com","host_ip":"142.251.156.119:443","url":"/async/ddljson?async=ntp:2","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /async/ddljson?async=ntp:2 HTTP/2\nHost: www.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nCookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQ\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"host":"www.google.com","host_ip":"142.251.156.119:443","url":"/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2\nHost: www.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nCookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQ\nX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"host":"www.google.com","host_ip":"142.251.156.119:443","url":"/async/newtab_ogb?hl=en-US&async=fixed:0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2\nHost: www.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQ\nX-Client-Data: CKmdygEIveDKAQiTocsBCIWgzQE=\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"host":"www.google.com","host_ip":"142.251.156.119:443","url":"/async/newtab_promos","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /async/newtab_promos HTTP/2\nHost: www.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}],"processes":[{"pid":4004,"ppid":0,"name":"LA.exe","command_line":"","sha256":"3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","normalized_path":"C:\\LA.exe","uid":"00000000-00004004","icon":"$5b"},{"pid":1044,"ppid":4004,"name":"Dllhost.exe","command_line":"","sha256":"d9b3874aa63f62699d5ae1ade9959b45860d55233e93a1064d83b63307ea7435","normalized_path":"%WINDIR%\\SysWOW64\\Dllhost.exe","parent_uid":"00000000-00004004","uid":"00000000-00001044"},{"pid":3144,"ppid":0,"name":"rundll32.exe","command_line":"shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00003144","icon":"$5c"},{"pid":8008,"ppid":0,"name":"chrome.exe","command_line":"","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","uid":"00000000-00008008","icon":"$5d"},{"pid":2740,"ppid":8008,"name":"chrome.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Google\\Chrome\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Crashpad\" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=145.0.7632.75 --initial-client-data=0x148,0x14c,0x150,0xdc,0x154,0x7ffb44cb00a8,0x7ffb44cb00b4,0x7ffb44cb00c0","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00008008","uid":"00000000-00002740"},{"pid":2464,"ppid":8008,"name":"chrome.exe","command_line":"--type=gpu-process --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1560,i,17288562639332883780,16114697380755789601,262144 --field-trial-handle=1960,i,10963515717345426834,11630247059962766763,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1948 /prefetch:2","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00008008","uid":"00000000-00002464"},{"pid":1636,"ppid":8008,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=2056,i,14831406867593047894,16687070232419725328,524288 --field-trial-handle=1960,i,10963515717345426834,11630247059962766763,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2204 /prefetch:11","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00008008","uid":"00000000-00001636"},{"pid":6568,"ppid":8008,"name":"chrome.exe","command_line":"--type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1790235840838714 --launch-time-ticks=3448320259 --metrics-shmem-handle=3084,i,13754294273253065220,18227650695368448124,2097152 --field-trial-handle=1960,i,10963515717345426834,11630247059962766763,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3092 /prefetch:1","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00008008","uid":"00000000-00006568"},{"pid":7740,"ppid":8008,"name":"chrome.exe","command_line":"--type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1790235840838714 --launch-time-ticks=3448359648 --metrics-shmem-handle=3100,i,2025494857681973101,15243407773680673218,2097152 --field-trial-handle=1960,i,10963515717345426834,11630247059962766763,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3156 /prefetch:1","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00008008","uid":"00000000-00007740"},{"pid":7412,"ppid":8008,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --metrics-shmem-handle=2288,i,172406351054585261,128535946647448346,524288 --field-trial-handle=1960,i,10963515717345426834,11630247059962766763,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2664 /prefetch:13","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00008008","uid":"00000000-00007412"},{"pid":4112,"ppid":8008,"name":"chrome.exe","command_line":"--type=renderer --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1790235840838714 --launch-time-ticks=3450083148 --metrics-shmem-handle=4552,i,1460306662056078092,7805390096848771563,2097152 --field-trial-handle=1960,i,10963515717345426834,11630247059962766763,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4544 /prefetch:1","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00008008","uid":"00000000-00004112"},{"pid":6244,"ppid":8008,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=5496,i,14120137780527999447,9691031492020124337,524288 --field-trial-handle=1960,i,10963515717345426834,11630247059962766763,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5504 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00008008","uid":"00000000-00006244"},{"pid":8092,"ppid":8008,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=patch.mojom.FilePatcher --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --metrics-shmem-handle=5808,i,5944228792909561290,3712970843988352965,524288 --field-trial-handle=1960,i,10963515717345426834,11630247059962766763,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5816 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00008008","uid":"00000000-00008092"},{"pid":2128,"ppid":8008,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --metrics-shmem-handle=5812,i,11343927147367709699,17623820011200329262,524288 --field-trial-handle=1960,i,10963515717345426834,11630247059962766763,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5800 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00008008","uid":"00000000-00002128"},{"pid":4952,"ppid":8008,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --metrics-shmem-handle=5772,i,14548623870598510002,13981118113457167722,524288 --field-trial-handle=1960,i,10963515717345426834,11630247059962766763,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5760 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00008008","uid":"00000000-00004952"},{"pid":2608,"ppid":8008,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=6100,i,10158195451260917983,7820481834115097064,524288 --field-trial-handle=1960,i,10963515717345426834,11630247059962766763,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6092 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00008008","uid":"00000000-00002608"},{"pid":1748,"ppid":8008,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --metrics-shmem-handle=5164,i,16847112547354741186,7002933838268693177,524288 --field-trial-handle=1960,i,10963515717345426834,11630247059962766763,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6100 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00008008","uid":"00000000-00001748"},{"pid":5200,"ppid":8008,"name":"chrome.exe","command_line":"--type=renderer --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1790235840838714 --launch-time-ticks=3482653158 --metrics-shmem-handle=6180,i,1390474254923257020,1339435631480806943,2097152 --field-trial-handle=1960,i,10963515717345426834,11630247059962766763,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6188 /prefetch:9","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00008008","uid":"00000000-00005200"},{"pid":6828,"ppid":8008,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=2056,i,16436677109602584217,13811465685932907037,524288 --field-trial-handle=1960,i,10963515717345426834,11630247059962766763,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=2068 /prefetch:11","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00008008","uid":"00000000-00006828"},{"pid":2396,"ppid":0,"name":"msedge.exe","command_line":"","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00002396","icon":"$5e"},{"pid":2436,"ppid":2396,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x4c,0x150,0x2f4,0x2d0,0x358,0x7ffb2fcf0f18,0x7ffb2fcf0f24,0x7ffb2fcf0f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002396","uid":"00000000-00002436"},{"pid":8036,"ppid":2396,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1716,i,6246345512839287399,3240261204635819854,262144 --field-trial-handle=2036,i,12520051774180119828,6202709232997092380,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2032 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002396","uid":"00000000-00008036"},{"pid":7676,"ppid":2396,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1880,i,16119012155334054920,11666346711891556255,524288 --field-trial-handle=2036,i,12520051774180119828,6202709232997092380,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2064 /prefetch:11","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002396","uid":"00000000-00007676"},{"pid":7120,"ppid":2396,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2188,i,17915478312436176805,5263230127391989294,524288 --field-trial-handle=2036,i,12520051774180119828,6202709232997092380,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2832 /prefetch:13","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002396","uid":"00000000-00007120"},{"pid":1064,"ppid":2396,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1790235840838714 --launch-time-ticks=3464724620 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3120,i,10649283404884352060,13815494752403859541,2097152 --field-trial-handle=2036,i,12520051774180119828,6202709232997092380,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3280 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002396","uid":"00000000-00001064"},{"pid":2804,"ppid":2396,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1790235840838714 --launch-time-ticks=3464878745 --skip-read-main-dll --metrics-shmem-handle=3148,i,7157642809247728922,11127950457855374031,2097152 --field-trial-handle=2036,i,12520051774180119828,6202709232997092380,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3624 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002396","uid":"00000000-00002804"},{"pid":2380,"ppid":2396,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=4416,i,15668271352977861148,16464931724494680818,524288 --field-trial-handle=2036,i,12520051774180119828,6202709232997092380,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5016 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002396","uid":"00000000-00002380"},{"pid":8012,"ppid":2396,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=3888,i,16486478628088176774,10522504971021797859,524288 --field-trial-handle=2036,i,12520051774180119828,6202709232997092380,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5024 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002396","uid":"00000000-00008012"},{"pid":3780,"ppid":2396,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3108,i,14992301141231298684,10931598415451233139,524288 --field-trial-handle=2036,i,12520051774180119828,6202709232997092380,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3892 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002396","uid":"00000000-00003780"},{"pid":6360,"ppid":2396,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5128,i,3915738821597389367,2354033415484392242,524288 --field-trial-handle=2036,i,12520051774180119828,6202709232997092380,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5124 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002396","uid":"00000000-00006360"},{"pid":7624,"ppid":2396,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6216,i,3387517969883012582,8093027938683653397,524288 --field-trial-handle=2036,i,12520051774180119828,6202709232997092380,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6232 /prefetch:14","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00002396","uid":"00000000-00007624"},{"pid":7556,"ppid":2396,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=4992,i,4633260932462104554,5928925622740947391,524288 --field-trial-handle=2036,i,12520051774180119828,6202709232997092380,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6388 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002396","uid":"00000000-00007556"},{"pid":7348,"ppid":2396,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=6568,i,1039823050883570915,6221465492118509254,524288 --field-trial-handle=2036,i,12520051774180119828,6202709232997092380,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6412 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002396","uid":"00000000-00007348"},{"pid":7100,"ppid":2396,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6216,i,3387517969883012582,8093027938683653397,524288 --field-trial-handle=2036,i,12520051774180119828,6202709232997092380,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6232 /prefetch:14","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00002396","uid":"00000000-00007100"},{"pid":2956,"ppid":2396,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=1880,i,10175190743281184171,6196077697783526575,524288 --field-trial-handle=2036,i,12520051774180119828,6202709232997092380,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=3432 /prefetch:11","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002396","uid":"00000000-00002956"},{"pid":4348,"ppid":2396,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=6548,i,17294880725037591113,16801542059025628012,524288 --field-trial-handle=2036,i,12520051774180119828,6202709232997092380,262144 --variations-seed-version --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5988 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002396","uid":"00000000-00004348"},{"pid":468,"ppid":2396,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=6232,i,1866288926286032404,11961248510767149028,524288 --field-trial-handle=2036,i,12520051774180119828,6202709232997092380,262144 --variations-seed-version --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=6272 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002396","uid":"00000000-00000468"}],"all_imported_dlls":["tbs.dll","devobj.dll","mobilenetworking.dll","CapabilityAccessManagerClient.dll","credui.dll","DataExchange.dll","urlmon.dll","windowsudk.shellcommon.dll","msvcp_win.dll","StartMenu.dll","ffmpeg.dll","dusmapi.dll","omadmapi.dll","wow64base.dll","advapi32.dll","mswsock.dll","perfos.dll","WinTypes.dll","d3d10warp.dll","srvcli.dll","MpClient.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","wow64con.dll","vcruntime140.dll","Windows.UI.dll","twinapi.dll","libGLESv2.dll","wevtapi.dll","cfgmgr32.dll","oneauth.dll","netapi32.dll","ncrypt.dll","winmm.dll","CoreUIComponents.dll","coml2.dll","shell32.dll","InputHost.dll","VxSSL64.dll","mscms.dll","TenantRestrictionsPlugin.dll","AppXDeploymentClient.dll","Windows.StateRepository.dll","dpapi.dll","CoreMessaging.dll","Geolocation.dll","wbemprox.dll","fastprox.dll","nsi.dll","pdh.dll","Windows.Web.dll","Windows.Internal.Shell.Broker.dll","shlwapi.dll","microsoft_shell_integration.dll","netutils.dll","windows.storage.dll","wtsapi32.dll","FirewallAPI.dll","optimization_guide_internal.dll","cryptsp.dll","wininet.dll","sxs.dll","Windows.Storage.ApplicationData.dll","kernel32.dll","biwinrt.dll","ntdll.dll","msasn1.dll","RstrtMgr.dll","winsta.dll","VxSSL32.dll","DWrite.dll","wlanapi.dll","libEGL.dll","mpr.dll","winhttp.dll","gpapi.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","Windows.ApplicationModel.dll","msvcrt.dll","comctl32.dll","ktmw32.dll","mdmregistration.dll","OnDemandConnRouteHelper.dll","onnxruntime.dll","version.dll","umpdc.dll","apphelp.dll","AppResolver.dll","wow64.dll","npmproxy.dll","Windows.StateRepositoryPS.dll","dxcompiler.dll","xmllite.dll","wbemcomn.dll","chrome_elf.dll","gdi32.dll","profapi.dll","vcruntime140_1.dll","powrprof.dll","mf.dll","telclient.dll","TileDataRepository.dll","wow64win.dll","wintrust.dll","dhcpcsvc.dll","dnsapi.dll","Windows.Devices.Enumeration.dll","sspicli.dll","cryptbase.dll","wscapi.dll","chrome.dll","MMDevAPI.dll","RTWorkQ.dll","OneCoreCommonProxyStub.dll","AssignedAccessRuntime.dll","userenv.dll","KBDUS.DLL","DXCore.dll","mfplat.dll","imagehlp.dll","directxdatabasehelper.dll","slwga.dll","LocationFrameworkPS.dll","ws2_32.dll","uxtheme.dll","wbemsvc.dll","ExplorerFrame.dll","Windows.Networking.Connectivity.dll","dhcpcsvc6.dll","ngcksp.dll","msvcp140.dll","cryptngc.dll","Windows.StateRepositoryCore.dll","netprofm.dll","pfclient.dll","dcomp.dll","shdocvw.dll","webauthn.dll","atlthunk.dll","FWPUCLNT.DLL","wldp.dll","msvcp140_app.dll","ole32.dll","bcrypt.dll","DiagnosticDataSettings.dll","vcruntime140_1_app.dll","comdlg32.dll","nlansp_c.dll","CorePrivacySettingsStore.dll","capauthz.dll","win32u.dll","twinapi.appcore.dll","linkinfo.dll","UserMgrProxy.dll","dxil.dll","StartTileData.dll","wpnapps.dll","vaultcli.dll","MicrosoftAccountWAMExtension.dll","mscoree.dll","Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll","SHCore.dll","kernel.appcore.dll","rasadhlp.dll","Windows.StateRepositoryClient.dll","sechost.dll","dsreg.dll","mfcore.dll","d3dcompiler_47.dll","winnsi.dll","fltLib.dll","ResourcePolicyClient.dll","msedge_elf.dll","domain_actions.dll","execmodelproxy.dll","combase.dll","user32.dll","IPHLPAPI.DLL","oneds.dll","secur32.dll","MpOAV.dll","sppc.dll","wkscli.dll","clbcatq.dll","CryptoWinRT.dll","propsys.dll","ExecModelClient.dll","crypt32.dll","d3d11.dll","aadWamExtension.dll","dbghelp.dll","samcli.dll","dxgi.dll","directmanipulation.dll","ntasn1.dll","ncryptprov.dll","bcryptprimitives.dll","amsi.dll","Windows.System.Launcher.dll","usermgrcli.dll","rpcrt4.dll","msctf.dll","ntmarta.dll","Windows.UI.Immersive.dll","msvcp110_win.dll","StateRepository.Core.dll","wow64cpu.dll","BitsProxy.dll","vcruntime140_app.dll","KernelBase.dll","rsaenh.dll","Windows.FileExplorer.Common.dll","well_known_domains.dll","ucrtbase.dll","7jeDYkFJ.dll","TextInputFramework.dll","Windows.Media.dll","policymanager.dll","dwmapi.dll","gdi32full.dll","vk_swiftshader.dll","imm32.dll","OneCoreUAPCommonProxyStub.dll","AcLayers.dll","setupapi.dll","iertutil.dll","msedge.dll","Windows.System.Profile.RetailInfo.dll","Windows.Security.Authentication.Web.Core.dll","PCPKsp.dll","slc.dll","oleaut32.dll","fwbase.dll","oleacc.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\UAPUVUNIQCIYYEBCSFLVS","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\crashpad_8008_OUTTYZCHLLQTHHRS","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.5064.14789768151993535440","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.5064.11053792917867014922","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.5064.17485529472328339768","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.5064.11794487700657369356","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.4260.10001635291472172440","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.5064.635276376723553478","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.4260.12031875638442620524","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.4260.16793807373512185757","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.4260.7184902746071859397","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.5064.11615553915530026984","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.4260.18171790536336675035","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.5064.7163759677740649477","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.5064.17468601693693220336","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.5064.15149795632883684165","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.5064.11674545625450673411","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.5064.213704873294139713","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.5064.913044870431296346","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.8008.4260.13575803381906343747","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.6568.2564.4644465474456246275","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.7740.4292.1215975600861160664","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.4112.2460.15603696577742418426","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.5200.3520.9897645057452356460","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\crashpad_2396_JSSJWSKHGPVGKFLM","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6428.2986135605617908587","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6428.10305990084340082856","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6428.7277861892380130703","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6428.18307383082711097265","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6428.2315421829500118071","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6324.12390328444179915592","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6324.10159761904251060443","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6324.2447788860179104033","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6324.8785536030235175571","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6324.6027169604715611120","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6324.6516187770787210550","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6428.16364960985368024725","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6428.1894340747722705966","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6428.9848544329246123317","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6324.8048930553479851823","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6324.14603224306272203689","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.1716.14570881962484999971","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6428.10575626374204534684","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6428.9173473209429792118","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6428.3609737513630659367","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6324.13893816978920612334","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6428.1785566727813175447","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2396.6428.11533853780882306943","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.1064.1996.7012539343213738844","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"path":"pipe\\LOCAL\\mojo.2804.6640.9356859176434787123","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4004:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4004:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\minhook_multihook_00000FA4","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UAPUVUNIQCIYYEBCSFLVSXTHREOJKNE","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"minhook_multihook_00000FA4","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:4004:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"UAPUVUNIQCIYYEBCSFLVSXTHREOJKNE","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:4004:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:4004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:1044:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:1044:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"692950069","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1044:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1044:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\692950069","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3144:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3144:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:3144:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:3144:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8008:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"ServiceModelService 3.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"rdyboost_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"UGatherer_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":".NET Data Provider for Oracle_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"BITS_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Outlook_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":".NET Memory Cache 4.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"RemoteAccess_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"W3SVC_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":".NET Data Provider for SqlServer_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SMSvcHost 4.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":".NET CLR Data_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Mutex5a2098e080cf7ac4.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":".NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:8008:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"TapiSrv_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:8008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"TermService_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"WSearchIdxPi_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SMSvcHost 3.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"WmiApRpl_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Tcpip_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"ServiceModelEndpoint 3.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"usbhub_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Mutex5f7b5f1e01b83767.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"ASP.NET_4.0.30319_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"ServiceModelOperation 3.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"UGTHRSVC_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":".NET CLR Networking_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"ASP_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"PerfDisk_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"PerfNet_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Spooler_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:8008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"PerfProc_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":".NETFramework_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"ASP.NET_64_2.0.50727_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"ASP.NET_2.0.50727_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"aspnet_state_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"ESENT_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"ASP.NET_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Mutexf01b4d95cf55d32a.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:8008:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"PerfOS_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"LSM_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"MSDTC_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET CLR Data_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET CLR Networking_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET Data Provider for Oracle_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET Data Provider for SqlServer_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET Memory Cache 4.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NETFramework_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP.NET_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP.NET_2.0.50727_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP.NET_4.0.30319_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP.NET_64_2.0.50727_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\aspnet_state_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\BITS_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ESENT_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\LSM_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSDTC_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Outlook_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfDisk_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfNet_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfOS_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfProc_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\rdyboost_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RemoteAccess_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ServiceModelEndpoint 3.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ServiceModelOperation 3.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ServiceModelService 3.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SMSvcHost 3.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SMSvcHost 4.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Spooler_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\TapiSrv_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Tcpip_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\TermService_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UGatherer_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UGTHRSVC_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\usbhub_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\W3SVC_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\WmiApRpl_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\WSearchIdxPi_Perf_Library_Lock_PID_1f48","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Mutexf01b4d95cf55d32a.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Mutex5f7b5f1e01b83767.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Mutex5a2098e080cf7ac4.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8008:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:2740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:2740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:2464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:2464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:1636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:1636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6568:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:6568:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:7740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:4112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6244:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6244:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:6244:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:6244:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2128:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:2128:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2608:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:2608:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:2608:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:2608:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:2608:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2608:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2608:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2608:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1748:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:1748:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5200:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:5200:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6828:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:6828:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:6828:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6828:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2396:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2396:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2396:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2396:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:2396:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:2396:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:2396:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:2396:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:2436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:2436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8036:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:8036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:8036:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:8036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7676:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:7676:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:7120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\AppContainerNamedObjects\\S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-924012159-129201922\\SM0:2804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2380:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2380:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:2380:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:2380:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8012:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:8012:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3780:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:3780:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6360:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:6360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:6360:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:6360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7556:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:7556:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:7100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:7100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2956:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:2956:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"Local\\SM0:2956:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2956:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4348:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]},{"name":"SM0:4348:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab4e1e61894208a06045ea6"}]}]}},"report_ids":{"sandbox_job_ids":["6ab4e1e61894208a06045ea6"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Malware_ Sample 3ba215692665… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3ba215692665…. Malware family: Malware_. Threat score 100/100. 1/23 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware_ Sample 3ba215692665… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3ba215692665…. Malware family: Malware_. Threat score 100/100. 1/23 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware_ Sample 3ba215692665… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3ba215692665…. Malware family: Malware_. Threat score 100/100. 1/23 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5f","11",{}]]