34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 51:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T435,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 55d42961a831… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample 55d42961a831…. Threat score 35/100. 0/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff"],"about":{"@type":"SoftwareApplication","name":"real executor for win - official site.exe.lnk","applicationCategory":["lnk"],"identifier":"55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Tbb0,"identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\METADATA") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\USER\INDEX\USERSID\S-1-5-21-1271187874-1938232448-3812392235-1001") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\PACKAGEUSERSTATUS\INDEX\USERANDPACKAGEFULLNAME\3^MICROSOFTWINDOWS.CLIENT.CORE_1000.22634.1000.0_X64__CW5N1H2TXYEWY") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL\UPDATE\PACKAGES\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL\UPDATE\PACKAGES\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\METADATA") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\PACKAGEFAMILY\INDEX\PACKAGEFAMILYNAME\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\USER\DATA\3") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\USER\DATA\3") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\PACKAGE\INDEX\PACKAGEFAMILY") "identity_helper.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\PACKAGE\INDEX\PACKAGEFAMILY") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\PACKAGE\INDEX\PACKAGEFAMILY\22") "identity_helper.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\PACKAGE\INDEX\PACKAGEFAMILY\22") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\PACKAGE\DATA\124") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\PACKAGE\DATA\124") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\PACKAGEUSER\INDEX\USERANDPACKAGE\3^124") "identity_helper.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\STATEREPOSITORY\CACHE\PACKAGEUSER\INDEX\USERANDPACKAGE\3^124")37:T3542,Contains base64 string in header "keep" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "alivesec" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Edge" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Chromium" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "0sec" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "platform" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Insecure" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Requests" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "like" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "exchange" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "7Sec" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Site" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Mode" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "User" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "1Sec" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Dest" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Encoding" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "gzip" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Language" in header "GET /a/7z1900-x64.exe HTTP/1.1Host: www.7-zip.orgConnection: keep-alivesec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9"38:T1bd9,Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 81302; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 213236; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 279337; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 329224; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 530928; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 577615; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 582917; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 667632; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 718403; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 731321; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 807268; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 943962; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 957515; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 979530; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1024364; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1057277; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1097502; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1179170; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1198363; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1265318; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1363209; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1383635; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1403293; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1407681; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1434880; code bytes = 30d0 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 87884; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 127147; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 157471; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 160233; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 178845; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 245421; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 259556; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 268047; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 373356; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 442662; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 500745; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 573961; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 582754; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 635074; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 717717; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 856112; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 926459; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1079345; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1284221; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1336541; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1364304; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1371066; code bytes = 33c1 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 894727; code bytes = 30040e Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1033959; code bytes = 30040e Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 62246; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 64866; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 294398; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 342276; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 352500; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 361735; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 569834; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 614129; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 615706; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 641312; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 805143; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 831247; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 873705; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1077814; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1149882; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1235663; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1254243; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1286705; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1300442; code bytes = 8030 Found XOR loop in file "urlref_httpswww.7-zip.orga7z1900-x64.exe" at offset 1314704; code bytes = 803039:T77b,"identity_helper.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006696) "identity_helper.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006696) "identity_helper.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000003b4d8161fd7f0000d0b80773b9010000000000000000000058b6d74dfd7f000010330264fd7f000000000000000000000000944dfd7f000040bb8f214100000010416d61fd7f0000000000000000000000bb8f2141000000000000000000000000000000000000000100000000000000b8406d61fd7f0000f00300000000000001000000000000000000944dfd7f00003b4d8161fd7f00000000000000000000b8bf8f21410000000000000000000000a044a54dfd7f0000d09ad74dfd7f0000e8f86c61fd7f0000d09ad74dfd7f0000a044a54dfd7f00000d000000000000000d000000fd7f000048cdc94dfd7f0000059e9e4dfd7f0000a044a54d (UID: 00000000-00006696)3a:T7a2,"identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006696) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006696) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00006696) "identity_helper.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00006696) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006696) "identity_helper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006696) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006696) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006696) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006696) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00006696) "identity_helper.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Edge\Application\145.0.3800.58\msedge.dll (UID: 00000000-00006696) "identity_helper.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006696) "identity_helper.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006696) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006696) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006696) "identity_helper.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006696) "identity_helper.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006696)3b:T1a03,"identity_helper.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter RtlGetDeviceFamilyInfoEnum (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter PrefetchVirtualMemory (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter ChromeMain (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsGetStringRawBuffer (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006696) "identity_helper.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00006696)3c:T5c46,Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetThreadDescription"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetHandleVerifier"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "Event Name"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "IsValidAcl"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetProductInfo"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetThreadId"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetThreadPriority"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleInformation"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "QueryThreadCycleTime"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureStackBackTrace"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SetProcessShutdownParameters"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SetThreadInformation"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp")3d:T4cf,"SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000692.00000000.331894.32A00000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00000692.00000000.331894.32A00000.00000002.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006696.00000000.332218.00313000.00000004.mdmp 00000000-00006696.00000000.332218.7309B000.00000004.mdmp 00000000-00006696.00000001.332776.00313000.00000004.mdmp 00000000-00006696.00000001.332776.7309B000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006696.00000000.332218.00313000.00000004.mdmp 00000000-00006696.00000001.332776.00313000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006696.00000000.332218.00313000.00000004.mdmp 00000000-00006696.00000001.332776.00313000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00006696.00000000.332218.00313000.00000004.mdmp 00000000-00006696.00000001.332776.00313000.00000004.mdmp3e:Ta41,Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7308:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7308:120:WilError_03" Process msedge.exe created mutex with name "Local\SM0:7308:120:WilError_03" Process msedge.exe created mutex with name "Local\SM0:7308:304:WilStaging_02" Process msedge.exe created mutex with name "3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD" Process msedge.exe created mutex with name "Local\SessionImmersiveColorMutex" Process msedge.exe created mutex with name "Mutex5f7b5f1e01b83767.automaticDestinations-ms" Process msedge.exe created mutex with name "Mutex5a2098e080cf7ac4.automaticDestinations-ms" Process msedge.exe created mutex with name "__OMADM_NAMED_MUTEX__" Process msedge.exe created mutex with name "ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "SM0:7308:120:WilError_03" Process msedge.exe created mutex with name "SM0:7308:304:WilStaging_02" Process msedge.exe created mutex with name "Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process msedge.exe created mutex with name "Mutexf01b4d95cf55d32a.automaticDestinations-ms" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7308:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\__OMADM_NAMED_MUTEX__" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7308:120:WilError_03" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process msedge.exe created mutex with name "\BaseNamedObjects\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex" Process msedge.exe created mutex with name "\BaseNamedObjects\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer" Process msedge.exe created mutex with name "\BaseNamedObjects\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer" Process msedge.exe created mutex with name "\BaseNamedObjects\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer"3f:T1bcf,"SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000692.00000000.331894.32A00000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00000692.00000000.331894.32A00000.00000002.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006696.00000000.332218.00313000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006696.00000000.332218.00313000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006696.00000000.332218.00313000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00006696.00000000.332218.00313000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006696.00000000.332218.32A00000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00006696.00000000.332218.32A00000.00000002.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006696.00000000.332218.73046000.00000004.mdmp "\Registry\Machine\Software\C" in Source: 00000000-00006696.00000000.332218.73063000.00000004.mdmp "\Registry\Machine\Software\Classes\AllFilesystemObjects" in Source: 00000000-00006696.00000000.332218.73078000.00000004.mdmp "NVM_SYMLINK=C:\P\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}\Program" in Source: 00000000-00006696.00000000.332218.73078000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006696.00000000.332218.73078000.00000004.mdmp "S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe" in Source: 00000000-00006696.00000000.332218.73078000.00000004.mdmp "y\Machine\Software\Classes\I" in Source: 00000000-00006696.00000000.332218.7309B000.00000004.mdmp "Software\Classes\Interface\{A819F3DE-60AA-5159" in Source: 00000000-00006696.00000000.332218.7309B000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006696.00000000.332218.7309B000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace_36354489" in Source: 00000000-00006696.00000000.332218.7309B000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}" in Source: 00000000-00006696.00000000.332218.7309B000.00000004.mdmp "-1-5-21-1271187874-1938232448-3812392235-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\PSR" in Source: 00000000-00006696.00000000.332218.7309B000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager" in Source: 00000000-00006696.00000000.332218.7309B000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\" in Source: 00000000-00006696.00000000.332218.7309B000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006696.00000001.332776.00313000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006696.00000001.332776.00313000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006696.00000001.332776.00313000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00006696.00000001.332776.00313000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00006696.00000001.332776.35D01000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00006696.00000001.332776.35D01000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00006696.00000001.332776.35D01000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00006696.00000001.332776.35D01000.00000002.mdmp "Software\" in Source: 00000000-00006696.00000001.332776.35D01000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00006696.00000001.332776.35D01000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00006696.00000001.332776.35D01000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00006696.00000001.332776.35D01000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006696.00000001.332776.35D01000.00000002.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006696.00000001.332776.73046000.00000004.mdmp "\Registry\Machine\Software\C" in Source: 00000000-00006696.00000001.332776.73063000.00000004.mdmp "\Registry\Machine\Software\Classes\AllFilesystemObjects" in Source: 00000000-00006696.00000001.332776.73078000.00000004.mdmp "NVM_SYMLINK=C:\P\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}\Program" in Source: 00000000-00006696.00000001.332776.73078000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006696.00000001.332776.73078000.00000004.mdmp "S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe" in Source: 00000000-00006696.00000001.332776.73078000.00000004.mdmp "y\Machine\Software\Classes\I" in Source: 00000000-00006696.00000001.332776.7309B000.00000004.mdmp "Software\Classes\Interface\{A819F3DE-60AA-5159" in Source: 00000000-00006696.00000001.332776.7309B000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006696.00000001.332776.7309B000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace_36354489" in Source: 00000000-00006696.00000001.332776.7309B000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}" in Source: 00000000-00006696.00000001.332776.7309B000.00000004.mdmp "-1-5-21-1271187874-1938232448-3812392235-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\PSR" in Source: 00000000-00006696.00000001.332776.7309B000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager" in Source: 00000000-00006696.00000001.332776.7309B000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\" in Source: 00000000-00006696.00000001.332776.7309B000.00000004.mdmp40:T45e,Launches browser "msedge.exe" (UID: 00000000-00004720) Launches browser "msedge.exe" (UID: 00000000-00005636) Launches browser "msedge.exe" (UID: 00000000-00003820) Launches browser "msedge.exe" (UID: 00000000-00004004) Launches browser "msedge.exe" (UID: 00000000-00007652) Launches browser "msedge.exe" (UID: 00000000-00001320) Launches browser "msedge.exe" (UID: 00000000-00007604) Launches browser "msedge.exe" (UID: 00000000-00002060) Launches browser "msedge.exe" (UID: 00000000-00004224) Launches browser "msedge.exe" (UID: 00000000-00007588) Launches browser "msedge.exe" (UID: 00000000-00006240) Launches browser "msedge.exe" (UID: 00000000-00004852) Launches browser "msedge.exe" (UID: 00000000-00001248) Launches browser "msedge.exe" (UID: 00000000-00005400) Launches browser "msedge.exe" (UID: 00000000-00001292) Launches browser "msedge.exe" (UID: 00000000-00005468) Launches browser "msedge.exe" (UID: 00000000-00005196) Launches browser "msedge.exe" (UID: 00000000-00004636) Launches browser "msedge.exe" (UID: 00000000-00005712) Launches browser "msedge.exe" (UID: 00000000-00007476)41:T1339,"identity_helper.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd1a1d0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd617d0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd617d0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffd617d0000 "identity_helper.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffd61d50000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd617d0000 "identity_helper.exe" loaded module "KERNEL32" at base 7ffd630f0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffd617d0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffd617d0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffd617d0000 "identity_helper.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 1b975220000 "identity_helper.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGE\APPLICATION\145.0.3800.58\MSEDGE.DLL" at base 7ffd1c940000 "identity_helper.exe" loaded module "ADVAPI32.DLL" at base 7ffd61eb0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffd5ea20000 "identity_helper.exe" loaded module "USER32.DLL" at base 7ffd639b0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffd633b0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffd633b0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\EXECMODELCLIENT.DLL" at base 7ffd4b140000 "identity_helper.exe" loaded module "RPCRT4.DLL" at base 7ffd63880000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffd633b0000 "identity_helper.exe" loaded module "OLE32.DLL" at base 7ffd63df0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.APPCORE.DLL" at base 7ffd5a9f0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WPNAPPS.DLL" at base 7ffd471b0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 7ffd4d610000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\EXECMODELPROXY.DLL" at base 7ffd4a450000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffd5a3d0000 "identity_helper.exe" loaded module "NTDLL.DLL" at base 7ffd63fd0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\BIWINRT.DLL" at base 7ffd4d0c0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffd5f2b0000 "identity_helper.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 1b903a00000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.APPLICATIONMODEL.DLL" at base 7ffd4a4b0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffd61d50000 "identity_helper.exe" loaded module "COMBASE.DLL" at base 7ffd633b0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTOWINRT.DLL" at base 7ffd42de0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\TILEDATAREPOSITORY.DLL" at base 7ffd47a10000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\USERMGRPROXY.DLL" at base 7ffd4c160000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffd4d2a0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.INTERNAL.SHELL.BROKER.DLL" at base 7ffd426f0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\STARTTILEDATA.DLL" at base 7ffd47ac0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSUDK.SHELLCOMMON.DLL" at base 7ffd4d940000 "identity_helper.exe" loaded module "API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL" at base 7ffd616b0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\APPXDEPLOYMENTCLIENT.DLL" at base 7ffd57e90000 "identity_helper.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1.DLL" at base 7ffd60440000 "identity_helper.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 7ffd60440000 "identity_helper.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ffd617d0000 "identity_helper.exe" loaded module "EXT-MS-ONECORE-APPMODEL-STATEREPOSITORY-CACHE-L1-1-0.DLL" at base 7ffd57be0000 "identity_helper.exe" loaded module "EXT-MS-ONECORE-APPMODEL-STATEREPOSITORY-CACHE-L1-1-2.DLL" at base 7ffd57be0000 "identity_helper.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-INTERNAL-L1-1-2.DLL" at base 7ffd60440000 "identity_helper.exe" loaded module "STARTMENU.DLL" at base 7ffd427f0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.APPLICATIONDATA.DLL" at base 7ffd434d0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffd5afa0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffd5f3f000042:T2421,Process "msedge.exe" (UID: 00000000-00004720) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_7308_ZGYVGFBQJDDYXZQL", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="7308"" Process "msedge.exe" (UID: 00000000-00005636) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="48", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="1918044760612785876"" Process "msedge.exe" (UID: 00000000-00004004) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, USERNAME, ProgramFiles(x86), CURL_CA_BUNDLE, FPS_BROWSER_USER_PROFILE_STRING, PATHEXT, DriverData, ProgramData, ProgramW6432, HOMEPATH, EFC_5220, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, windir, USERDOMAIN, FPS_BROWSER_APP_PROFILE_STRING, LOGONSERVER, PROMPT, OneDrive, APPDATA, CommonProgramFiles, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, HOMEDRIVE, USERPROFILE, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007588) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="48", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="U3nDx30", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", FPS_BROWSER_USER_PROFILE_STRING="Default", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", DriverData="%WINDIR%\System32\Drivers\DriverData", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\U3nDx30", EFC_5220="1", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", windir="C:\WINDOWS", USERDOMAIN="Yt3tSvfEXLnwwn5", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", LOGONSERVER="\\DESKTOP-8LD9T6N", PROMPT="$P$G", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", CommonProgramFiles="%PROGRAMFILES%\Common Files", OS="Windows_NT", COMPUTERNAME="Yt3tSvfEXLnwwn5", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", HOMEDRIVE="C:", USERPROFILE="C:\Users\U3nDx30", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", NUMBER_OF_PROCESSORS="2", EDGE_METRICS_CLIENT_ID_HASH="1918044760612785876"" Process "msedge.exe" (UID: 00000000-00006240) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, USERNAME, ProgramFiles(x86), CURL_CA_BUNDLE, FPS_BROWSER_USER_PROFILE_STRING, PATHEXT, DriverData, ProgramData, ProgramW6432, HOMEPATH, EFC_5220, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, windir, USERDOMAIN, FPS_BROWSER_APP_PROFILE_STRING, LOGONSERVER, PROMPT, OneDrive, APPDATA, CommonProgramFiles, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, HOMEDRIVE, USERPROFILE, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS, EDGE_METRICS_CLIENT_ID_HASH" Process "identity_helper.exe" (UID: 00000000-00000692) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="48", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="U3nDx30", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", FPS_BROWSER_USER_PROFILE_STRING="Default", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", DriverData="%WINDIR%\System32\Drivers\DriverData", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\U3nDx30", EFC_5220="1", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", windir="C:\WINDOWS", USERDOMAIN="Yt3tSvfEXLnwwn5", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", LOGONSERVER="\\DESKTOP-8LD9T6N", PROMPT="$P$G", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", CommonProgramFiles="%PROGRAMFILES%\Common Files", OS="Windows_NT", COMPUTERNAME="Yt3tSvfEXLnwwn5", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", HOMEDRIVE="C:", USERPROFILE="C:\Users\U3nDx30", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", NUMBER_OF_PROCESSORS="2", EDGE_METRICS_CLIENT_ID_HASH="1918044760612785876"" Process "msedge.exe" (UID: 00000000-00005400) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_7308_ZGYVGFBQJDDYXZQL", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="7308"" Process "msedge.exe" (UID: 00000000-00005400) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00005400) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "msedge.exe" (UID: 00000000-00005196) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="48", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="U3nDx30", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", FPS_BROWSER_USER_PROFILE_STRING="Default", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", DriverData="%WINDIR%\System32\Drivers\DriverData", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\U3nDx30", EFC_5220="1", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", windir="C:\WINDOWS", USERDOMAIN="Yt3tSvfEXLnwwn5", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", LOGONSERVER="\\DESKTOP-8LD9T6N", PROMPT="$P$G", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", CommonProgramFiles="%PROGRAMFILES%\Common Files", OS="Windows_NT", COMPUTERNAME="Yt3tSvfEXLnwwn5", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", HOMEDRIVE="C:", USERPROFILE="C:\Users\U3nDx30", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", NUMBER_OF_PROCESSORS="2", EDGE_METRICS_CLIENT_ID_HASH="1918044760612785876"" Process "msedge.exe" (UID: 00000000-00004636) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, USERNAME, ProgramFiles(x86), CURL_CA_BUNDLE, FPS_BROWSER_USER_PROFILE_STRING, PATHEXT, DriverData, ProgramData, ProgramW6432, HOMEPATH, EFC_5220, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, windir, USERDOMAIN, FPS_BROWSER_APP_PROFILE_STRING, LOGONSERVER, PROMPT, OneDrive, APPDATA, CommonProgramFiles, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, HOMEDRIVE, USERPROFILE, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS, EDGE_METRICS_CLIENT_ID_HASH"43:Tc5a,Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00004720), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00005636), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00003820), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004004), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007652), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00001320), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00007604), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00002060), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_collections.mojom.Collect ..." (UID: 00000000-00004224), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00007588), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --disable-gpu-compositing - ..." (UID: 00000000-00006240), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00000692), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00006696), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00004852), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00001248), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005400), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001292), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005468), Spawned process "msedge.exe" with commandline "--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu ..." (UID: 00000000-00005196), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00004636), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005712), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007476)44:Tc5a,Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00004720), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00005636), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00003820), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004004), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007652), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00001320), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00007604), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00002060), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_collections.mojom.Collect ..." (UID: 00000000-00004224), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=quarantine.mojom.Quarantine -- ..." (UID: 00000000-00007588), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --disable-gpu-compositing - ..." (UID: 00000000-00006240), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00000692), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00006696), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00004852), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00001248), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005400), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001292), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005468), Spawned process "msedge.exe" with commandline "--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu ..." (UID: 00000000-00005196), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00004636), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005712), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007476)45:T6b3,The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 ECC CA OCSP 06, O=Microsoft Corporation, C=US" (SHA1: EF:0D:BE:18:E6:CB:44:39:F7:17:83:17:1A:49:AA:88:74:F7:2D:2F; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS ECC Root G2, O=Microsoft Corporation, C=US" (SHA1: 9B:C5:75:46:AC:BD:B2:9E:38:8C:D1:79:1B:43:DE:4F:65:9B:84:4B; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7F:A0:5A:CF:9B:4A:AB:B0:DE:0C:FA:FA:29:7D:DF:92:FD:C5:F3:F5; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E; see report for more information) The input sample is signed with a certificate issued by "CN=YE1, O=Let's Encrypt, C=US" (SHA1: C2:92:C2:F1:06:84:08:C0:6A:F2:15:99:AE:20:10:B2:73:18:A5:17; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: D0:93:70:A9:86:49:82:A5:04:7D:A4:63:73:54:02:56:D0:8A:3C:81; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information)46:T8d7,"identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\THEMES\PERSONALIZE"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{50AC103F-D235-4598-BBEF-98FE4D1A3AD4}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{50AC103F-D235-4598-BBEF-98FE4D1A3AD4}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{50AC103F-D235-4598-BBEF-98FE4D1A3AD4}\PROXYSTUBCLSID32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{50AC103F-D235-4598-BBEF-98FE4D1A3AD4}\PROXYSTUBCLSID32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}\TREATAS"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}\TREATAS"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}\INPROCSERVER32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}\INPROCSERVER32"; Key: ""; Value: "")47:T976,"identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\THEMES\PERSONALIZE"; Key: "APPSUSELIGHTTHEME"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "673CF800-208A-5327-3F4B-2BE44A66627A"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "EBADF775-48AA-4BF3-8F8E-EC68D113C98E"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{50AC103F-D235-4598-BBEF-98FE4D1A3AD4}\PROXYSTUBCLSID32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}\INPROCSERVER32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}"; Key: "APPID"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7AB93C52-0E48-4750-BA9D-1A4113981847}\PROXYSTUBCLSID32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{5CADDC63-01D3-4C97-986F-0533483FEE14}\PROXYSTUBCLSID32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3BC3D253-2F31-4092-9129-8AD5ABF067DA}\PROXYSTUBCLSID32"; Key: ""; Value: "")48:T48b,"identity_helper.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "identity_helper.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "identity_helper.exe" trying to touch file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\identity_helper.exe" "identity_helper.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "identity_helper.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "identity_helper.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "identity_helper.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "identity_helper.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "identity_helper.exe" trying to touch file "C:\Program Files (x86)\Microsoft\Edge\Application\msedge_elf.dll" "identity_helper.exe" trying to touch file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\msedge_elf.dll" "identity_helper.exe" trying to touch file "C:\Program Files (x86)\Microsoft\Edge\Application\dbghelp.dll" "identity_helper.exe" trying to touch file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\dbghelp.dll"49:Ta80,"identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\msedge_elf.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\dbghelp.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\dbghelp.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\WINMM.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\WINMM.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\FLTLIB.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\FLTLIB.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\MSVCP140.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\VCRUNTIME140.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\VCRUNTIME140_1.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\CRYPTSP.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\CRYPTSP.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\msvcp110_win.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\bcrypt.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\bcrypt.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\StateRepository.Core.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\Windows.StateRepository.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\IPHLPAPI.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\USERENV.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\XmlLite.dll" "identity_helper.exe" trying to access non-existent file "C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\PROPSYS.dll"4a:Tb0a,file/memory contains long string with (Indicator: " connect "; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 day and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found reference to API "other {This device will be saved for {DAYS} days and you can connect without a code next time. This is set by your administrator.}}{HOURS, plural," (Indicator: " connect "; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 hour and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found reference to API "other {This device will be saved for {HOURS} hours and you can connect without a code next time. This is set by your administrator.}}{MONTHS, plural," (Indicator: " connect "; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 month and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found reference to API "other {This device will be saved for {MONTHS} months and you can connect without a code next time. This is set by your administrator.}}{YEARS, plural," (Indicator: " connect "; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 year and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") file/memory contains long string with (Indicator: " bind "; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found reference to API "USB device from $2 (product $1)USB devices from $1USB device ($2:$1)USB devices from vendor $1Any serial port$1 wants to connect to a HID deviceUnknown Device ($1)Finding HID devices" (Indicator: " connect "; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found reference to API "your organization requires Microsoft Edge to connect to the Internet and" (Indicator: " connect "; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found reference to API "t use a secure connection this time. An attacker might be trying to eavesdrop or modify your network connection. $1You usually connect to sites securely, but Microsoft Edge couldn" (Indicator: " connect "; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp")4b:T15ee5,Found URL "https://www.office.comthumbnail" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2093703https://go.microsoft.com/fwlink/?linkid=2348603sites" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://support.google.com/chromebook?p=app_intent" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2118167" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/en-us/privacystatementyou're" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://aka.ms/edgepreviewhttps://aka.ms/enterprisepreviewuserto" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2149872an" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2165400to" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2165278https://go.microsoft.com/fwlink/?linkid=2348701https://go.microsoft.com/fwlink/?linkid=2165325https://go.microsoft.com/fwlink/?linkid=2348900use" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2239343https://go.microsoft.com/fwlink/?linkid=2288290show" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2301855allow" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2149000browsing" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2194724ai-powered" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/microsoft-edge/microsoft-edge-browsing-activity-for-personalized-advertising-and-experiences-37aa831e-6372-238e-f33f-7cd3f0e53679allow" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/microsoft-365/family-safetyhttps://family.microsoft.com/?ref=edge://settings/familysafetyhttps://go.microsoft.com/fwlink/?linkid=2127630set" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/account-billing/view-device-and-app-use-with-family-safety-activity-reporting-b7b8501e-e35c-2224-bed8-115d5da4fbafto" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/account-billing/filter-websites-and-searches-using-microsoft-family-safety-3034d91e-5efa-9fbe-1384-46009f087ccfto" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://microsoftedgetips.microsoft.com/en-us/internet" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2211966writing" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://support.microsoft.com/office/microsoft-editor-checks-grammar-and-more-in-documents-mail-and-the-web-91ecbe1b-d021-4e9e-a82e-abc4cd7163d7are" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=521839microsoft" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2279846see" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2166676learn" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://easylist.to/easylist/easylist.txtthe" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://easylist.to/index.htmlallow" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2181135adds" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2161865alerts" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://aka.ms/techscam-detection-learn-moreblock" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=529732manage" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2105403this" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2114187https://go.microsoft.com/fwlink/?linkid=2077327edit" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2121003when" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/servicesagreementmanage" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2101140change" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://aka.ms/accountsecuritylearn" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://aka.ms/synclearnmorelinkprofile" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/deployedge/edge-learnmore-reset-data-in-cloudreset" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2333202save" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2167671use" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://example.comsuper" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2257424keep" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/edge/features/real-time-video-translation?form=ma13fj&ch=1show" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://microsoft.com/en-us/edge/ai-powered/copilot-mode?form=ma140nhttps://microsoft.com/en-us/edge/ai-powered/copilot-mode?form=ma140mcopilot" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337798https://go.microsoft.com/fwlink/?linkid=2337885explore" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337628https://go.microsoft.com/fwlink/?linkid=2345959explore" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337721https://go.microsoft.com/fwlink/?linkid=2345869discover" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addons" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addonsno" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://aka.ms/edgeprintingtroubleshooting" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://aka.ms/printtroubleshootingneed" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2126235if" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://www.bing.com/new/termsofuseenhanceenhance" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://www.microsoft.com/edge/copilot-mode?form=mg0awropen" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/copilot/privacy-and-protections" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/microsoft-365-copilot/microsoft-365-copilot-privacy" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://aka.ms/whatisscarewarequick" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2107360&clcid=0x409hi," - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "http://force" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2164373" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2164373the" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addons?hl=enhttps://www.whatsapp.comhttps://www.facebook.comhttps://www.youtube.comhttps://www.outlook.com/allow" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2151738learn" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "http://example.com" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://example.com.your" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://support.google.com/chrome/a/answer/9122284" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "http://.

" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "http://," - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "http://example.com." - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/p/?linkid=2114059" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/p/\?linkid=158334https://support.microsoft.com/en-us/windows/microsoft-edge-" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/topic/protect-your-online-accounts-using-password-monitor-6f660aae-65aa-476c-871a-7fe2bcb0c4c1let's" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2193240check" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/en-us/privacystatement" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2189718protected" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/privacystatementalways" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://m365.cloud.microsoft/chat?fromcode=cmm63o75lj0let's" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "http://microsoft.com/edge/surfintroducing" - Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00006696.00000000.332218.00300000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00006696.00000000.332218.00300000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00006696.00000000.332218.00300000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00006696.00000000.332218.00300000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00006696.00000000.332218.00300000.00000004.mdmp") Found URL "https://www.microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.systemtrayglobal.systemtrayglobal.systemtrayassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.core_cw5n1h2txyewy!global.taskbarglobal.taskbarglobal.taskbarassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comv<<:6microsoftwindows.client.core_cw5n1h2txyewy!global.fileexplorerextensionsglobal.fileexplorerextensionsglobal.fileexplorerextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.snaplayoutglobal.snaplayoutglobal.snaplayoutassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxv" - Source: "00000000-00006696.00000000.332218.00300000.00000004.mdmp") Found URL "http://microsoft.com@windows" - Source: "00000000-00006696.00000000.332218.00300000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00006696.00000000.332218.00313000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00006696.00000000.332218.00313000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00006696.00000000.332218.00313000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00006696.00000000.332218.00313000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00006696.00000000.332218.00313000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00006696.00000000.332218.00324000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00006696.00000000.332218.00324000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00006696.00000000.332218.00324000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00006696.00000000.332218.00324000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00006696.00000000.332218.00324000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00006696.00000000.332218.00335000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00006696.00000000.332218.00335000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00006696.00000000.332218.00335000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00006696.00000000.332218.00335000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00006696.00000000.332218.00335000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00006696.00000000.332218.73078000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00006696.00000000.332218.73078000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00006696.00000000.332218.73078000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00006696.00000000.332218.73078000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00006696.00000000.332218.73078000.00000004.mdmp") Found URL "https://www.microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.systemtrayglobal.systemtrayglobal.systemtrayassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.core_cw5n1h2txyewy!global.taskbarglobal.taskbarglobal.taskbarassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comv<<:6microsoftwindows.client.core_cw5n1h2txyewy!global.fileexplorerextensionsglobal.fileexplorerextensionsglobal.fileexplorerextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.snaplayoutglobal.snaplayoutglobal.snaplayoutassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxv" - Source: "00000000-00006696.00000000.332218.73078000.00000004.mdmp") Found URL "http://microsoft.com@windows" - Source: "00000000-00006696.00000000.332218.73078000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00006696.00000000.332218.730E6000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00006696.00000000.332218.730E6000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00006696.00000000.332218.730E6000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00006696.00000000.332218.730E6000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00006696.00000000.332218.730E6000.00000004.mdmp") Found URL "https://www.microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.systemtrayglobal.systemtrayglobal.systemtrayassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.core_cw5n1h2txyewy!global.taskbarglobal.taskbarglobal.taskbarassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comv<<:6microsoftwindows.client.core_cw5n1h2txyewy!global.fileexplorerextensionsglobal.fileexplorerextensionsglobal.fileexplorerextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.snaplayoutglobal.snaplayoutglobal.snaplayoutassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxv" - Source: "00000000-00006696.00000000.332218.730E6000.00000004.mdmp") Found URL "http://microsoft.com@windows" - Source: "00000000-00006696.00000000.332218.730E6000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00006696.00000001.332776.00300000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00006696.00000001.332776.00300000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00006696.00000001.332776.00300000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00006696.00000001.332776.00300000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00006696.00000001.332776.00300000.00000004.mdmp") Found URL "https://www.microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.systemtrayglobal.systemtrayglobal.systemtrayassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.core_cw5n1h2txyewy!global.taskbarglobal.taskbarglobal.taskbarassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comv<<:6microsoftwindows.client.core_cw5n1h2txyewy!global.fileexplorerextensionsglobal.fileexplorerextensionsglobal.fileexplorerextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.snaplayoutglobal.snaplayoutglobal.snaplayoutassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxv" - Source: "00000000-00006696.00000001.332776.00300000.00000004.mdmp") Found URL "http://microsoft.com@windows" - Source: "00000000-00006696.00000001.332776.00300000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00006696.00000001.332776.00313000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00006696.00000001.332776.00313000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00006696.00000001.332776.00313000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00006696.00000001.332776.00313000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00006696.00000001.332776.00313000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00006696.00000001.332776.00324000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00006696.00000001.332776.00324000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00006696.00000001.332776.00324000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00006696.00000001.332776.00324000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00006696.00000001.332776.00324000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00006696.00000001.332776.00335000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00006696.00000001.332776.00335000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00006696.00000001.332776.00335000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00006696.00000001.332776.00335000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00006696.00000001.332776.00335000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00006696.00000001.332776.00346000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00006696.00000001.332776.00346000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00006696.00000001.332776.00346000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00006696.00000001.332776.00346000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00006696.00000001.332776.00346000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00006696.00000001.332776.73078000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00006696.00000001.332776.73078000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00006696.00000001.332776.73078000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00006696.00000001.332776.73078000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00006696.00000001.332776.73078000.00000004.mdmp") Found URL "https://www.microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.systemtrayglobal.systemtrayglobal.systemtrayassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.core_cw5n1h2txyewy!global.taskbarglobal.taskbarglobal.taskbarassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comv<<:6microsoftwindows.client.core_cw5n1h2txyewy!global.fileexplorerextensionsglobal.fileexplorerextensionsglobal.fileexplorerextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.snaplayoutglobal.snaplayoutglobal.snaplayoutassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxv" - Source: "00000000-00006696.00000001.332776.73078000.00000004.mdmp") Found URL "http://microsoft.com@windows" - Source: "00000000-00006696.00000001.332776.73078000.00000004.mdmp") Found URL "https://www.microsoft.comtt" - Source: "00000000-00006696.00000001.332776.730E6000.00000004.mdmp") Found URL "http://microsoft.com" - Source: "00000000-00006696.00000001.332776.730E6000.00000004.mdmp") Found URL "http://microsoft.comt88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.desktopstickereditorglobal.desktopstickereditorglobal.desktopstickereditorassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt>>:6microsoftwindows.client.cbs_cw5n1h2txyewy!desktopstickereditorcentennialdesktopstickereditorcentennialdesktopstickereditorcentennialassets\square150x150logo.pngassets\square44x44logo.png" - Source: "00000000-00006696.00000001.332776.730E6000.00000004.mdmp") Found URL "http://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!inputappms-resource:appdisplaynamewindowsinternal.composableshell.experiences.textinputundocked.inputappinputapp\assets\squarelogo150x150.pnginputapp\assets\squarelogo44x44.pngt6plhmicrosoftwindows.client.cbs_cw5n1h2txyewy!global.textinputextensionsglobal.textinputextensionsui" - Source: "00000000-00006696.00000001.332776.730E6000.00000004.mdmp") Found URL "http://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.irisserviceglobal.irisserviceglobal.irisserviceassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt66:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.livecaptionsdesktopglobal.livecaptionsdesktopglobal.livecaptionsdesktopassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.cbs_cw5n1h2txyewy!logonwebhostlogonwebhostlogonwebhostassets\square150x150logo.pngassets\square44x44logo.png+https://login.microsoftonline.com/tpp:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerglobal.microsoftgraphrecentitemsmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comrtnlxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!screenclippingms-resource:screenclippingappname/textms-resource:screenclippingdescriptionscreenclipping\assets\square150x150logo.pngscreenclipping\assets\square44x44logo.pngntbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!minisearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pnghtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!cortanauims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngjtbzxtmicrosoftwindows.client.cbs_cw5n1h2txyewy!fesearchuims-resource:cortana.ui/resources/tiledisplaynamems-resource:cortana.ui/resources/descriptioncortana.ui\assets\app\square150x150logo.pngcortana.ui\assets\app\square44x44logo.pngtdd:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.speechsynthesizerextensionglobal.speechsynthesizerextensionglobal.speechsynthesizerextensionassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.familyvaluepropglobal.familyvaluepropglobal.familyvaluepropassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzt&&:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.valuebannerglobal.valuebannerglobal.valuebannerassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comt..:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.voiceaccesshostglobal.voiceaccesshostglobal.voiceaccesshostassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxttr::microsoftwindows.client.cbs_cw5n1h2txyewy!webexperiencehostms-resource:webexperiencehostappname/textms-resource:webexperiencehostdescriptionassets\getstartedmedtile.pngassets\getstartedapplist.png+https://prod.rewardsplatform.microsoft.com/a+https://www.microsoft.com/officeoobe/a+https://wwwqa.microsoft.com/officeoobe/+https://onedrive.live.com/windows/+https://account.live.com/+https://login.live.com/a+https://oloobe.officeapps.live.com/a+https://oloobe.officeapps.live-int.com/+https://login.microsoftonline.com/+https://login.microsoft.com/+https://login.windows.net/+https://login.windows-ppe.net/+https://signup.live.com/+https://account.live-int.com/+https://login.live-int.com/+https://signup.live-int.com/+https://buy.live.com/+https://buy.live-int.com/+https://passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.com/+https://tip.passwordreset.microsoftonline.com/+https://account.activedirectory.windowsazure.us/+https://account.activedirectory.windowsazure.cn/+https://passwordreset.activedirectory.windowsazure.cn/+https://password.ccsctp.com/+https://account.activedirectory-ppe.windowsazure.com/a+https://sdx.microsoft.com/a+https://sdx.microsoft-ppe.com/a+https://sdx.microsoft-int.com/+https://canary.sdx.microsoft.com/a+ms-appx-web:///webapps/a+ms-appx-web:///views/a+ms-appx-web:///retaildemo/a+ms-appx-web:///core/+https://login.microsoftonline.us/+https://login.microsoftonline.de/+https://login.partner.microsoftonline.cn/t88:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.experienceextensionsglobal.experienceextensionsglobal.experienceextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.comt,,:6microsoftwindows.client.cbs_cw5n1h2txyewy!global.wsxpackmanagerglobal.wsxpackmanagerglobal.wsxpackmanagerassets\square150x150logo.pngassets\square44x44logo.pnghttps://microsoft.com@windows" - Source: "00000000-00006696.00000001.332776.730E6000.00000004.mdmp") Found URL "https://www.microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.systemtrayglobal.systemtrayglobal.systemtrayassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.commicrosoftwindows.client.core_cw5n1h2txyewy!global.taskbarglobal.taskbarglobal.taskbarassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comv<<:6microsoftwindows.client.core_cw5n1h2txyewy!global.fileexplorerextensionsglobal.fileexplorerextensionsglobal.fileexplorerextensionsassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comzv$$:6microsoftwindows.client.core_cw5n1h2txyewy!global.snaplayoutglobal.snaplayoutglobal.snaplayoutassets\square150x150logo.pngassets\square44x44logo.pnghttp://microsoft.comxv" - Source: "00000000-00006696.00000001.332776.730E6000.00000004.mdmp") Found URL "http://microsoft.com@windows" - Source: "00000000-00006696.00000001.332776.730E6000.00000004.mdmp")4c:T1389,Found string "passwords" (Indicator: "password"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found string "password_manager" (Indicator: "password"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found string "password_manager.mojom.CSVPasswordParser" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.00004000.00000004.mdmp") Found string "password_manager.breach_detection.mojom.EdgePasswordDataProcessor" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.00054000.00000004.mdmp") Found string "passwords" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000BC000.00000004.mdmp, 00000000-00006696.00000000.332218.32A00000.00000002.mdmp, 00000000-00006696.00000001.332776.000BC000.00000004.mdmp, 00000000-00006696.00000001.332776.35D01000.00000002.mdmp") Found string "password_manager" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000BC000.00000004.mdmp, 00000000-00006696.00000000.332218.32A00000.00000002.mdmp, 00000000-00006696.00000001.332776.000BC000.00000004.mdmp, 00000000-00006696.00000001.332776.35D01000.00000002.mdmp") Found string "your password stays on your deviceAdding to Microsoft Edge" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "=1 {1 password is saved only to this device. To use it on your other devices, save it in your Google Account. This will also clean up any duplicates.}" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "other {{PASSWORD_COUNT} passwords are saved only to this device. To use them on your other devices, save them in your Google Account. This will also clean up any duplicates.}" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "=1 {1 password and other items are saved only to this device. To use them on your other devices, save them in your Google Account. This will also clean up any duplicates.}" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "other {{PASSWORD_COUNT} passwords and other items are saved only to this device. To use them on your other devices, save them in your Google Account. This will also clean up any duplicates.}" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "=1 {1 password is saved only to this device. To use it on your other devices, save it in your Google Account.}" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "other {{PASSWORD_COUNT} passwords are saved only to this device. To use them on your other devices, save them in your Google Account.}" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "=1 {1 password and other items are saved only to this device. To use them on your other devices, save them in your Google Account.}" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "other {{PASSWORD_COUNT} passwords and other items are saved only to this device. To use them on your other devices, save them in your Google Account.}" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "ve imported 1 password into Microsoft Password Manager on this device.Great! We" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "ve imported $1 passwords into Microsoft Password Manager on this device.We" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "ve imported your passwordsTo continue to save your passwords in Microsoft Edge, turn on" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "=1 {Found 1 compromised password}" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "other {Found {NUM_SITES} compromised passwords}}{NUM_SITES, plural," (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "=0 {No compromised passwords}" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "=1 {{COUNT} compromised password}" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "other {{COUNT} compromised passwords}}{COUNT, plural," (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp") Found string "=0 {Your passwords are unique}" (Indicator: "password"; Source: "00000000-00006696.00000000.332218.000F0000.00000002.mdmp")4d:T80f,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00006696.00000000.332218.00054000.00000004.mdmp, 00000000-00006696.00000000.332218.00300000.00000004.mdmp, 00000000-00006696.00000000.332218.00313000.00000004.mdmp, 00000000-00006696.00000000.332218.73013000.00000004.mdmp, 00000000-00006696.00000000.332218.73063000.00000004.mdmp, 00000000-00006696.00000000.332218.73078000.00000004.mdmp, 00000000-00006696.00000000.332218.730E6000.00000004.mdmp, 00000000-00006696.00000000.332218.730F7000.00000004.mdmp, 00000000-00006696.00000001.332776.00054000.00000004.mdmp, 00000000-00006696.00000001.332776.00300000.00000004.mdmp, 00000000-00006696.00000001.332776.00313000.00000004.mdmp, 00000000-00006696.00000001.332776.73013000.00000004.mdmp, 00000000-00006696.00000001.332776.73063000.00000004.mdmp, 00000000-00006696.00000001.332776.73078000.00000004.mdmp, 00000000-00006696.00000001.332776.730E6000.00000004.mdmp, 00000000-00006696.00000001.332776.730F7000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00006696.00000000.332218.00054000.00000004.mdmp, 00000000-00006696.00000000.332218.00300000.00000004.mdmp, 00000000-00006696.00000000.332218.00313000.00000004.mdmp, 00000000-00006696.00000000.332218.73013000.00000004.mdmp, 00000000-00006696.00000000.332218.73063000.00000004.mdmp, 00000000-00006696.00000000.332218.73078000.00000004.mdmp, 00000000-00006696.00000000.332218.730E6000.00000004.mdmp, 00000000-00006696.00000000.332218.730F7000.00000004.mdmp, 00000000-00006696.00000001.332776.00054000.00000004.mdmp, 00000000-00006696.00000001.332776.00300000.00000004.mdmp, 00000000-00006696.00000001.332776.00313000.00000004.mdmp, 00000000-00006696.00000001.332776.73013000.00000004.mdmp, 00000000-00006696.00000001.332776.73063000.00000004.mdmp, 00000000-00006696.00000001.332776.73078000.00000004.mdmp, 00000000-00006696.00000001.332776.730E6000.00000004.mdmp, 00000000-00006696.00000001.332776.730F7000.00000004.mdmp")4e:T67e,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00000692.00000000.331894.32A00000.00000002.mdmp")4f:T453,"GET /a/7z1900-x64.exe HTTP/1.1 Host: www.7-zip.org Connection: keep-alive sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sat 14 Nov 2026 08:48:08 GMT Content-Type: application/octet-stream Content-Length: 1447178 Last-Modified: Fri 22 Feb 2019 09:30:09 GMT Connection: keep-alive ETag: "5c6fc121-16150a" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000.......50:T453,"GET /a/7z1900-x64.exe HTTP/1.1 Host: www.7-zip.org Connection: keep-alive sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sat 14 Nov 2026 08:48:08 GMT Content-Type: application/octet-stream Content-Length: 1447178 Last-Modified: Fri 22 Feb 2019 09:30:09 GMT Connection: keep-alive ETag: "5c6fc121-16150a" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000.......30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1794646370344,"unified_at":"2026-11-14T08:52:50.344Z","metadata":{"hashes":{"sha256":"55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff","sha1":"5be602c88a26b51b38f437fb3e0db08399437435","md5":"cc6a26ba5529940c655822407ff5a311","sha512":"e5f78f0f5956b13236a01f995599a12396ebb3110dc1635d387c9e8889acf9d7895df8a62b4b827a92b462df26dd8ea816d2fce24cf782484da4b6847a6429f6","ssdeep":"12:8EEXN/sD5xS8gfXi9Q1XxRXNZYylaBQ1Xx:89/sDxCX/NrNZRJN","ssdeep_chunks":["12:8EEXN/s","12:EEXN/sD","12:EXN/sD5","12:XN/sD5x","12:N/sD5xS","12:/sD5xS8","12:sD5xS8g","12:D5xS8gf","12:5xS8gfX","12:xS8gfXi","12:S8gfXi9","12:8gfXi9Q","12:gfXi9Q1","12:fXi9Q1X","12:Xi9Q1Xx","12:i9Q1XxR","12:9Q1XxRX","12:Q1XxRXN","12:1XxRXNZ","12:XxRXNZY","12:xRXNZYy","12:RXNZYyl","12:XNZYyla","12:NZYylaB","12:ZYylaBQ","12:YylaBQ1","12:ylaBQ1X","12:laBQ1Xx","24:8EEXN/s","24:EEXN/sD","24:EXN/sD5","24:XN/sD5x","24:N/sD5xS","24:/sD5xS8","24:sD5xS8g","24:D5xS8gf","24:5xS8gfX","24:xS8gfXi","24:S8gfXi9","24:8gfXi9Q","24:gfXi9Q1","24:fXi9Q1X","24:Xi9Q1Xx","24:i9Q1XxR","24:9Q1XxRX","24:Q1XxRXN","24:1XxRXNZ","24:XxRXNZY","24:xRXNZYy","24:RXNZYyl","24:XNZYyla","24:NZYylaB","24:ZYylaBQ","24:YylaBQ1","24:ylaBQ1X","24:laBQ1Xx","12:89/sDxC","12:9/sDxCX","12:/sDxCX/","12:sDxCX/N","12:DxCX/Nr","12:xCX/NrN","12:CX/NrNZ","12:X/NrNZR","12:/NrNZRJ","12:NrNZRJN"],"imphash":"Unknown"},"file_info":{"file_name":"real executor for win - official site.exe.lnk","file_type":["lnk"],"file_type_id":"file link","file_size":1114,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794646058000,"last_seen":1794646059000,"last_multi_scan":1794646059000},"additional_metadata":[{"name":"lnk","type":"obj","values":[{"name":"window_state","type":"str","values":["SW_NORMAL"]},{"name":"description","type":"str","values":["Discription"]},{"name":"target_file_size","type":"int","values":[0]},{"name":"clsid","type":"str","values":["00021401-0000-0000-c000-000000000046"]},{"name":"icon_location","type":"str","values":["C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\2923.tmp\\l9HaZS8P"]},{"name":"link_flags","type":"array","values":["HasTargetIDList","HasName","HasIconLocation","IsUnicode","RunInSeparateProcess"]}]}]},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":56},"sandbox_signatures":{"informative_count":121,"suspicious_count":9,"malicious_count":1,"total":131},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Discovery","technique":"Cloud Service Dashboard","attack_id":"T1538","attack_id_wiki":"https://attack.mitre.org/techniques/T1538","identifiers":[{"type":"informative","value":"Able to retrieve cloud service dashboard"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"References URL in command line"},{"type":"suspicious","value":"GETs/downloads executable files from web server"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Able to download payload via Wget"},{"type":"informative","value":"Dropped files"},{"type":"malicious","value":"GETs executable from a web server (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"suspicious","value":"GETs files from a web server"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Stealth","technique":"LNK Icon Smuggling","attack_id":"T1027.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/012","identifiers":[{"type":"suspicious","value":"Drops shortcut file metadata payload delivery"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.7\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://www.7-zip.org/a/7z1900-x64.exe\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA512 block transform for x86_64, CRYPTOGAMS by \" (Indicator: \"SHA512\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to \"RC2V\" (Indicator: \"RC2\"; Source: \"00000000-00006696.00000000.332218.01100000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 56DB0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"msedge.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$36","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"identity_helper.exe\" queried SystemProcessInformation at 00000000-00006696-00000C15-3701832450 [PID: 6696]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00006696-00000C15-3701839842 [PID: 6696]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00006696-00000C15-3702077892 [PID: 6696]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00006696-00000C15-3702086423 [PID: 6696]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00006696-00000C15-3703757835 [PID: 6696]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00006696-00000C15-3703769132 [PID: 6696]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00006696-00000C15-3704527026 [PID: 6696]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00006696-00000C15-3704534521 [PID: 6696]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$37","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$38","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"00000000-00006696.00000000.332218.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"file/memory contains long string with (Indicator: \"/cookies\"; Source: \"00000000-00006696.00000000.332218.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"identity_helper.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006696)\n \"identity_helper.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00006696)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"identity_helper.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006696)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"identity_helper.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006696)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$39","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"identity_helper.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"identity_helper.exe\" queried token user identity (UID: 00000000-00006696)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/27 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.7-zip.org\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"89.167.91.206:443\"\n \"150.171.110.7:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileFromAppW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3e","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlref_httpswww.7-zip.orga7z1900-x64.exe\" as clean (type is \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"\n Pattern match: \"r@uma.negativesamples.reason\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - EDGE_CRASHPAD_PIPE_NAME=\\\\.\\pipe\\crashpad_7308_ZGYVGFBQJDDYXZQL","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3f","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"$40","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$41","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 61D50000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 60CD0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 63880000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00000000002042a461fd7f0000@ntdll.dll\"\n \"22002300000000004042a461fd7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"real executor for win - official site.exe.lnk\" was detected as \"Windows Shortcut (.LNK)\" and name: \"Format\"\n \"urlref_httpswww.7-zip.orga7z1900-x64.exe\" was detected as \"Windows Shortcut (.LNK)\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"identity_helper.exe\" touched \"Windows Push Notification Developer Proxy Stub\" (Path: \"HKCU\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}\")\n \"identity_helper.exe\" touched \"Windows Search Manager\" (Path: \"HKCU\\CLSID\\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\\TREATAS\")\n \"identity_helper.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"identity_helper.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\\TREATAS\")\n \"identity_helper.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")\n \"identity_helper.exe\" touched \"Property System Apartment Class Factory\" (Path: \"HKCU\\CLSID\\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}\\TREATAS\")\n \"identity_helper.exe\" touched \"ShellItem Shell Namespace helper\" (Path: \"HKCU\\CLSID\\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$42","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"edge-consumer-static.azureedge.net\"\n \"www.7-zip.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$43","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$44","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$45","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"urlref_httpswww.7-zip.orga7z1900-x64.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"identity_helper.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"urlref_httpswww.7-zip.orga7z1900-x64.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"msedge.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00007308)\n \"msedge.exe\" opens a process \"C:\\Windows\\System32\\svchost.exe\" (UID: 00000000-00007308)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"identity_helper.exe\" queries basic process information of the \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe\" (UID: 6696)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"identity_helper.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge.Stable_144.0.3719.104_neutral__8wekyb3d8bbwe\\ActivationStore.dat\"\n \"identity_helper.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\LocalState\\ToastCollectionIcons\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Network Related","name":"Able to download payload via Wget","description":"file/memory contains long string(Source: \"00000000-00006696.00000000.332218.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-963","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve cloud service dashboard","description":"file/memory contains long string(Source: \"00000000-00006696.00000000.332218.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1538","relevance":1,"id":"string-777","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /a/7z1900-x64.exe\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"+https://onedrive.live.com/windows/\" (Indicator: \"onedrive.live.com\"; Source: \"00000000-00006696.00000000.332218.00300000.00000004.mdmp, 00000000-00006696.00000000.332218.00313000.00000004.mdmp, 00000000-00006696.00000000.332218.00324000.00000004.mdmp, 00000000-00006696.00000000.332218.00335000.00000004.mdmp, 00000000-00006696.00000000.332218.73078000.00000004.mdmp, 00000000-00006696.00000000.332218.7309B000.00000004.mdmp, 00000000-00006696.00000000.332218.730E6000.00000004.mdmp, 00000000-00006696.00000001.332776.00300000.00000004.mdmp, 00000000-00006696.00000001.332776.00313000.00000004.mdmp, 00000000-00006696.00000001.332776.00324000.00000004.mdmp, 00000000-00006696.00000001.332776.00335000.00000004.mdmp, 00000000-00006696.00000001.332776.00346000.00000004.mdmp, 00000000-00006696.00000001.332776.73078000.00000004.mdmp, 00000000-00006696.00000001.332776.7309B000.00000004.mdmp, 00000000-00006696.00000001.332776.730E6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"mx._\" [Source: 00000000-00006696.00000000.332218.01100000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /a/7z1900-x64.exe HTTP/1.1\nHost: www.7-zip.org\nConnection: keep-alive\nsec-ch-ua: \"Not:A-Brand\";v=\"99\"\n \"Microsoft Edge\";v=\"145\"\n \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"Windows\"\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept: text/html\napplication/xhtml+xml\napplication/xml;q=0.9\nimage/avif\nimage/webp\nimage/apng\n*/*;q=0.8\napplication/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: none\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nAccept-Encoding: gzip\n deflate\n br\n zstd\nAccept-Language: en-US\nen;q=0.9\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://www.7-zip.org/a/7z1900-x64.exe","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"www.7-zip.org\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"89.167.91.206\" on port \"443\"\n HTTPS traffic to \"150.171.110.7\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"F+ncalrpc:[OLEB4AF4D4569C529343FEFDF854949]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006696.00000000.332218.00300000.00000004.mdmp, 00000000-00006696.00000000.332218.73063000.00000004.mdmp, 00000000-00006696.00000000.332218.73078000.00000004.mdmp, 00000000-00006696.00000000.332218.7309B000.00000004.mdmp, 00000000-00006696.00000001.332776.00300000.00000004.mdmp, 00000000-00006696.00000001.332776.73063000.00000004.mdmp, 00000000-00006696.00000001.332776.73078000.00000004.mdmp, 00000000-00006696.00000001.332776.7309B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegGetValueW\" in \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"identity_helper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"identity_helper.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)\" (Indicator: \"aes\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found string \"AES for Intel AES-NI, CRYPTOGAMS by \" (Indicator: \"aes\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found string \"AES-NI GCM module for x86_64, CRYPTOGAMS by \" (Indicator: \"aes\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"base64\"; Source: \"00000000-00006696.00000000.332218.000F0000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"ecdsa\"; Source: \"00000000-00006696.00000000.332218.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesExFromAppW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00000692.00000000.331894.32A00000.00000002.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00006696.00000000.332218.000BC000.00000004.mdmp\n 00000000-00006696.00000000.332218.32A00000.00000002.mdmp\n 00000000-00006696.00000001.332776.000BC000.00000004.mdmp\n 00000000-00006696.00000001.332776.35D01000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"identity_helper.exe\" opened \"\\Device\\KsecDD\"\n \"msedge.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Drops shortcut file metadata payload delivery","description":"\"urlref_httpswww.7-zip.orga7z1900-x64.exe\" contains indicator \"http://\"\n \"urlref_httpswww.7-zip.orga7z1900-x64.exe\" contains indicator \".js\"","origin":"Binary File","mitre_attack_id":"T1027.012","relevance":3,"id":"binary-79","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00000692.00000000.331894.32A00000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"process monitor\"; Source: \"00000000-00006696.00000000.332218.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"suspicious","category":"General","name":"GETs files from a web server","description":"$4f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"suspicious","category":"General","name":"References URL in command line","description":"Process \"msedge.exe\" with commandline \"--single-argument https://www.7-zip.org/a/7z1900-x64.exe\" (UID: 00000000-00007308)","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":1,"id":"target-174","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"urlref_httpswww.7-zip.orga7z1900-x64.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"suspicious","category":"Network Related","name":"GETs/downloads executable files from web server","description":"$50","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":3,"id":"network-37","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" connects to 150.171.27.11 on port 80 (TCP)\n Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" connects to 89.167.91.206 on port 443 (TCP); Domain: \"www.7-zip.org\"\n Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" connects to 150.171.22.17 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" connects to 150.171.110.7 on port 443 (TCP); Domain: \"edge-consumer-static.azureedge.net\"\n Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" connects to 150.171.27.10 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" connects to 142.250.65.78 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" connects to 74.151.238.132 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" connects to 150.171.27.11 on port 443 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"other {Some of these files are encrypted. Ask their owner to decrypt.}}Your administrator says: \"$1\"$1 has sensitive or dangerous data. Your administrator says: \"$2\"Discard filePlease enter a reason for uploading this data:Please enter a reason for pasting this data:Please enter a reason for printing this data:Please enter a reason for downloading this data:Save to cloud storage$1 has sensitive or dangerous data. Your organization will let you save it to cloud storage or discard itData SharingGet more protection against dangerous websites and downloadsClose tipEnhanced Safe Browsing is offYou have Microsoft Edge's strongest security against dangerous websites, downloads and extensionsYou're getting standard security protection. To get more protection against dangerous websites, downloads, and extensions, turn on Enhanced Safe Browsing in Microsoft Edge settings.Microsoft Edge settings{NUM_SUB_APPS, plural,\" (Source: 00000000-00006696.00000000.332218.000F0000.00000002.mdmp, Indicator: \"files are encrypted\")","origin":"File/Memory","mitre_attack_id":"T1491.001","relevance":5,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a web server (HTTPS)","description":"GET /a/7z1900-x64.exe HTTP/1.1\nHost: www.7-zip.org\nConnection: keep-alive\nsec-ch-ua: \"Not:A-Brand\";v=\"99\"\n \"Microsoft Edge\";v=\"145\"\n \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"Windows\"\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept: text/html\napplication/xhtml+xml\napplication/xml;q=0.9\nimage/avif\nimage/webp\nimage/apng\n*/*;q=0.8\napplication/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: none\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nAccept-Encoding: gzip\n deflate\n br\n zstd\nAccept-Language: en-US\nen;q=0.9\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]}],"intel_graph":{"map":{"Domain:edge-consumer-static.azureedge.net":{"type":"Domain","value":"edge-consumer-static.azureedge.net"},"Domain:www.7-zip.org":{"type":"Domain","value":"www.7-zip.org"},"File:0f5d4dbbe5e55b7aa31b91e5925ed901fdf46a367491d81381846f05ad54c45e":{"type":"File","value":"0f5d4dbbe5e55b7aa31b91e5925ed901fdf46a367491d81381846f05ad54c45e"},"File:55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff":{"type":"File","value":"55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff"},"Ip:150.171.110.7":{"type":"Ip","value":"150.171.110.7"},"Ip:89.167.91.206":{"type":"Ip","value":"89.167.91.206"},"Url:/a/7z1900-x64.exe":{"type":"Url","value":"/a/7z1900-x64.exe"}},"chains":[{"id":"sandbox_network","root":"File:55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff","edges":[{"edge_kind":"contacted_ip","from_key":"File:55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff","to_key":"Ip:89.167.91.206"},{"edge_kind":"contacted_ip","from_key":"File:55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff","to_key":"Ip:150.171.110.7"},{"edge_kind":"contacted_domain","from_key":"File:55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff","to_key":"Domain:edge-consumer-static.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edge-consumer-static.azureedge.net","to_key":"Ip:150.171.110.7"},{"edge_kind":"contacted_domain","from_key":"File:55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff","to_key":"Domain:www.7-zip.org"},{"edge_kind":"resolves_to","from_key":"Domain:www.7-zip.org","to_key":"Ip:89.167.91.206"},{"edge_kind":"contacted_url","from_key":"File:55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff","to_key":"Url:/a/7z1900-x64.exe"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff","edges":[{"edge_kind":"extracted","from_key":"File:55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff","to_key":"File:0f5d4dbbe5e55b7aa31b91e5925ed901fdf46a367491d81381846f05ad54c45e"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":23,"spawned_processes_count":23,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":114,"imported_dlls_count":205,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":32,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6af8202a765ea736e40febb4","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"contacted_countries":["DEU","USA"],"submit_name":"real executor for win - official site.exe.lnk","analysis_start_time":"2026-11-14T08:47:39+00:00","indicators_count":{"informative":120,"suspicious":10,"malicious":1},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"89.167.91.206","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"address":"150.171.110.7","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]}],"dns_resolutions":[{"domain":"edge-consumer-static.azureedge.net","address":"150.171.110.7","ttl":1787,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"domain":"www.7-zip.org","address":"89.167.91.206","ttl":15,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]}],"http_requests":[{"host":"www.7-zip.org","host_ip":"89.167.91.206:443","url":"/a/7z1900-x64.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /a/7z1900-x64.exe HTTP/1.1\nHost: www.7-zip.org\nConnection: keep-alive\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"Windows\"\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: none\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}],"processes":[{"pid":7308,"ppid":0,"name":"msedge.exe","command_line":"--single-argument https://www.7-zip.org/a/7z1900-x64.exe","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00007308","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB70lEQVR4Xu2TO0vDUBiGnUVBZydBNwfBwX/gDxGcXAoWLyAoar2BqKuuLg4i4ujitd6t1lJtk6ZpapLWtqmXQSzIa07VWHMO5aQRcegLDw05nPd7cpLW1PzHDPV7MTRQIeZer9cLe6ejkKJCoVARZO/Y6LA7CbcCSkJ2J+FWgPy6kvgNAVcSvyVAqEjCXuIE1l7HEqwSXmamJui/5ieDA38gUA7Sa5/FTFWgKlAVqAr8qUA684RU5hE64f4Bmomazhe5SxlI6gYUPYeEZqJmkTWeqWJemAJkqJPElAxVzAtTgDypkwhymirmhSlAjrc0j69v6FrX0bmqFelYuUPv1r21HpFSVDEvTAHZfK/2jBzl4dnJomU5gcYFCW1LsrUWFjWqmBemgJTMlIz+zvShgYY5EU3zIloXY9b9UFSlinlhCgiJdMnYj0z5DdTPCpjcz6F7TUXzbNRaC94mqWJemAKReKpkNDB5kEPddBS+3Y9X49nU0b4oWuuBsEIV88IUCMc0q9y3l0WtL4KJnZ/fRf7lzbo+D8lUMS9MgZCgWuU9GzrGt9nfxFdOgnGqmBemQDCStM8om6NLiSrmhSkQuFHsM8rGfyEWiyqiv48WODWP9OxaxinBvCZHfHwlFZ/0MBCDn2AOPfhk/1ygS1zkHXJuozGhs3qQAAAAAElFTkSuQmCC"},{"pid":4720,"ppid":7308,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ffd35df0f18,0x7ffd35df0f24,0x7ffd35df0f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00004720"},{"pid":5636,"ppid":7308,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1904,i,3816596943044465816,10935935391825817078,524288 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2124 /prefetch:11","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00005636"},{"pid":3820,"ppid":7308,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1836,i,17286945679161388666,13677494360968505170,262144 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2076 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00003820"},{"pid":4004,"ppid":7308,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2356,i,12874048118895603863,8804449263441802363,524288 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2748 /prefetch:13","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00004004"},{"pid":7652,"ppid":7308,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1794640911269619 --launch-time-ticks=5173014231 --skip-read-main-dll --metrics-shmem-handle=3356,i,15441953734906955823,5200014114473290277,2097152 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3540 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00007652"},{"pid":1320,"ppid":7308,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1794640911269619 --launch-time-ticks=5172992202 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3268,i,4843087042590918076,15974264734813825503,2097152 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3284 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00001320"},{"pid":7604,"ppid":7308,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=5076,i,16664759318118980408,9846508718733889233,524288 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5144 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00007604"},{"pid":2060,"ppid":7308,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5084,i,15827328580033140887,3576449103657227358,524288 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5180 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00002060"},{"pid":4224,"ppid":7308,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --skip-read-main-dll --metrics-shmem-handle=5816,i,1717194894850394712,11672573457788760185,524288 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5832 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00004224"},{"pid":7588,"ppid":7308,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=5904,i,11103154791155042676,14740741122406726901,524288 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5892 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00007588"},{"pid":6240,"ppid":7308,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1794640911269619 --launch-time-ticks=5178334116 --skip-read-main-dll --metrics-shmem-handle=5828,i,13659214549305663193,17790553101421141010,2097152 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5884 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00006240"},{"pid":692,"ppid":7308,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6016,i,4649311411268339362,10637586624669966770,524288 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5940 /prefetch:14","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00007308","uid":"00000000-00000692"},{"pid":6696,"ppid":7308,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6016,i,4649311411268339362,10637586624669966770,524288 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5940 /prefetch:14","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00007308","uid":"00000000-00006696"},{"pid":4852,"ppid":7308,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5940,i,14218514009617174505,1345477855654887986,524288 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6296 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00004852"},{"pid":1248,"ppid":7308,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5668,i,1327874608936685674,1194649863520142477,524288 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5968 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00001248"},{"pid":5400,"ppid":7308,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=5320,i,15282283339062864932,15715489163776243194,524288 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5084 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00005400"},{"pid":1292,"ppid":7308,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=6960,i,5213576850455322635,14467928352303473572,524288 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=4652 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00001292"},{"pid":5468,"ppid":7308,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4632,i,5440920166765787732,2758664409911176646,524288 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=4844 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00005468"},{"pid":5196,"ppid":7308,"name":"msedge.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22621.1194 --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --skip-read-main-dll --metrics-shmem-handle=6412,i,8560456715136090091,6012893744637837234,262144 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=3284 /prefetch:10","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00005196"},{"pid":4636,"ppid":7308,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=6412,i,11314797031079654898,2726889371237419081,524288 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=4160 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00004636"},{"pid":5712,"ppid":7308,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3208,i,1205385179984122707,13706296586003893962,524288 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5700 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00005712"},{"pid":7476,"ppid":7308,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5256,i,8222912321318226567,17296548449466764686,524288 --field-trial-handle=2080,i,17951116019245681865,9504087313404582031,262144 --variations-seed-version --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=5684 /prefetch:14","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007308","uid":"00000000-00007476"}],"all_imported_dlls":["clbcatq.dll","winhttp.dll","cryptsp.dll","WindowsCodecs.dll","wlanapi.dll","directml.dll","ntdll.dll","bcryptprimitives.dll","dhcpcsvc6.dll","setupapi.dll","mscms.dll","CoreMessaging.dll","DataExchange.dll","netutils.dll","Windows.StateRepositoryCore.dll","msasn1.dll","Windows.System.Profile.RetailInfo.dll","capauthz.dll","libGLESv2.dll","d3d11.dll","OneCoreCommonProxyStub.dll","MicrosoftAccountWAMExtension.dll","dpapi.dll","oneauth.dll","sspicli.dll","policymanager.dll","dusmapi.dll","dwmapi.dll","sxs.dll","sechost.dll","umpdc.dll","wtsapi32.dll","KernelBase.dll","shlwapi.dll","powrprof.dll","bcrypt.dll","oleacc.dll","CoreUIComponents.dll","wscapi.dll","SHCore.dll","KBDUS.DLL","DWrite.dll","winsta.dll","iertutil.dll","onnxruntime.dll","wininet.dll","CryptoWinRT.dll","combase.dll","mdmregistration.dll","wintrust.dll","apphelp.dll","slc.dll","MpOAV.dll","MpClient.dll","propsys.dll","UserMgrProxy.dll","usermgrcli.dll","ncryptprov.dll","msvcp140.dll","D3D12.dll","winmm.dll","gpapi.dll","comctl32.dll","dhcpcsvc.dll","directmanipulation.dll","Windows.ApplicationModel.dll","mobilenetworking.dll","srvcli.dll","version.dll","winnsi.dll","biwinrt.dll","gdi32full.dll","CorePrivacySettingsStore.dll","Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll","RTWorkQ.dll","dcomp.dll","D3D12Core.dll","wldp.dll","linkinfo.dll","OneCoreUAPCommonProxyStub.dll","VxSSL64.dll","Windows.Storage.ApplicationData.dll","gdi32.dll","cfgmgr32.dll","webauthn.dll","netprofm.dll","AppResolver.dll","ResourcePolicyClient.dll","urlmon.dll","StartMenu.dll","Windows.Web.dll","PCPKsp.dll","OnDemandConnRouteHelper.dll","vcruntime140_app.dll","D3DSCache.dll","msedge.dll","ole32.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","Windows.System.Launcher.dll","InputHost.dll","aadWamExtension.dll","ExplorerFrame.dll","netapi32.dll","kernel32.dll","advapi32.dll","WinTypes.dll","oleaut32.dll","mfplat.dll","d3d10warp.dll","vcruntime140_1.dll","StartTileData.dll","nlansp_c.dll","atlthunk.dll","fwbase.dll","TenantRestrictionsPlugin.dll","rasadhlp.dll","winshfhc.dll","wdscore.dll","Windows.Security.Authentication.Web.Core.dll","cryptbase.dll","dnsapi.dll","well_known_domains.dll","microsoft_shell_integration.dll","Windows.Networking.Connectivity.dll","BitsProxy.dll","dxgi.dll","rpcrt4.dll","profapi.dll","devobj.dll","twinapi.appcore.dll","dbghelp.dll","d3dcompiler_47.dll","Windows.Internal.Shell.Broker.dll","vaultcli.dll","imm32.dll","omadmapi.dll","crypt32.dll","nsi.dll","AssignedAccessRuntime.dll","Windows.FileExplorer.Common.dll","thumbcache.dll","ucrtbase.dll","msvcp_win.dll","kernel.appcore.dll","TextInputFramework.dll","Windows.StateRepositoryClient.dll","ncrypt.dll","tbs.dll","sppc.dll","msedge_elf.dll","ntasn1.dll","DXCore.dll","fltLib.dll","TileDataRepository.dll","wkscli.dll","msvcp140_app.dll","vcruntime140_1_app.dll","msvcrt.dll","windows.storage.dll","msctf.dll","npmproxy.dll","uxtheme.dll","Windows.UI.Immersive.dll","Windows.StateRepositoryPS.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","ExecModelClient.dll","Windows.StateRepository.dll","ntmarta.dll","twinapi.dll","rsaenh.dll","wpnapps.dll","slwga.dll","directxdatabasehelper.dll","shdocvw.dll","win32u.dll","DiagnosticDataSettings.dll","userenv.dll","ws2_32.dll","msvcp110_win.dll","secur32.dll","FirewallAPI.dll","wevtapi.dll","coml2.dll","AppXDeploymentClient.dll","telclient.dll","FWPUCLNT.DLL","windowsudk.shellcommon.dll","xmllite.dll","shell32.dll","Windows.UI.dll","cldapi.dll","mf.dll","libEGL.dll","execmodelproxy.dll","dxilconv.dll","user32.dll","dsreg.dll","IPHLPAPI.DLL","vcruntime140.dll","ffmpeg.dll","mswsock.dll","vk_swiftshader.dll","domain_actions.dll","oneds.dll","StateRepository.Core.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlref_httpswww.7-zip.orga7z1900-x64.exe","sha256":"0f5d4dbbe5e55b7aa31b91e5925ed901fdf46a367491d81381846f05ad54c45e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]}],"files_written":[{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\crashpad_7308_ZGYVGFBQJDDYXZQL","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.6513729980710630045","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.10123372501780439878","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.9175139006222389885","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.13998316326696151816","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.5004.17920480522751409566","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.9090881201351803340","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.8192294189868069980","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.5004.6303356369479992364","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.10654655418842314882","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.18137945306903350387","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.5004.13750689872928544322","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.5004.12364708724278840025","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.5004.12269484055594417664","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.5004.18339500907255138863","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.2068.10805477924203869578","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.14520600198742024557","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.7764551305412332721","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.17846283341444668314","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.7617609372408815742","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.17429089154916912079","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.4830398578735430242","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.851413761019377004","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.7726480247900926772","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7308.3204.14968609839060336076","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.7652.476.7408120624040657115","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.1320.4320.12305638114368444607","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"pipe\\LOCAL\\mojo.6240.3984.11872762207903934260","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7308:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7308:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Local\\SM0:7308:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Local\\SM0:7308:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Mutex5f7b5f1e01b83767.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Mutex5a2098e080cf7ac4.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:7308:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:7308:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Mutexf01b4d95cf55d32a.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7308:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7308:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\BaseNamedObjects\\C::Users:U3nDx30:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Mutexf01b4d95cf55d32a.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Mutex5f7b5f1e01b83767.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Mutex5a2098e080cf7ac4.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4720:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:4720:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Local\\SM0:4720:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4720:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:5636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Local\\SM0:5636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3820:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3820:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Local\\SM0:3820:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:3820:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:4004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\AppContainerNamedObjects\\S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-924012159-129201922\\SM0:7652:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\AppContainerNamedObjects\\S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-924012159-129201922\\SM0:1320:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7604:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:7604:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2060:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:2060:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4224:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:4224:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7588:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:7588:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Local\\SM0:7588:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:7588:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Local\\SM0:7588:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7588:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7588:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7588:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\AppContainerNamedObjects\\S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-924012159-129201922\\SM0:6240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:6696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Local\\SM0:6696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Local\\SM0:6696:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:6696:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6696:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6696:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4852:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4852:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Local\\SM0:4852:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:4852:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1248:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:1248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Local\\SM0:1248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:1248:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5400:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:5400:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1292:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:1292:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:5468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5196:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"Local\\SM0:5196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:5196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:5196:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:4636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5712:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:5712:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]},{"name":"SM0:7476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af8202a765ea736e40febb4"}]}]}},"report_ids":{"sandbox_job_ids":["6af8202a765ea736e40febb4"]}}}]]}] 2c:[["$","title","0",{"children":"Suspicious Sample 55d42961a831… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 55d42961a831…. Threat score 35/100. 0/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 55d42961a831… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 55d42961a831…. Threat score 35/100. 0/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/55d42961a831cfdb8cf0b6119a5932cdb520a97dd2d4319b6165f3472573b9ff"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 55d42961a831… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 55d42961a831…. Threat score 35/100. 0/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L51","11",{}]] 32:null