26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 9a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T499,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 7169885e9230… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7169885e9230…. Malware family: Trojan.Generic. Threat score 100/100. 7/27 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2"],"about":{"@type":"SoftwareApplication","name":"RDP OfficeX Manager.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T83b,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "::WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp")28:T8d5,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp")29:T41d,"msedgewebview2.exe" called "FindResourceW" with parameter "103" - (UID: 00000000-00006572) "msedgewebview2.exe" called "FindResourceW" with parameter "186" - (UID: 00000000-00006572) "msedgewebview2.exe" called "FindResourceW" with parameter "189" - (UID: 00000000-00006572) "msedgewebview2.exe" called "FindResourceW" with parameter "391" - (UID: 00000000-00006572) "msedgewebview2.exe" called "FindResourceW" with parameter "393" - (UID: 00000000-00006572) "msedgewebview2.exe" called "FindResourceW" with parameter "58204" - (UID: 00000000-00006572) "msedgewebview2.exe" called "FindResourceW" with parameter "51625" - (UID: 00000000-00006572) "msedgewebview2.exe" called "FindResourceW" with parameter "51637" - (UID: 00000000-00006572) "msedgewebview2.exe" called "FindResourceW" with parameter "58205" - (UID: 00000000-00006572) "msedgewebview2.exe" called "FindResourceA" with parameter "140703302368080" - (UID: 00000000-00007364) "msedgewebview2.exe" called "FindResourceA" with parameter "140703302368032" - (UID: 00000000-00007364)2a:T1153,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject crash dump requested" (Indicator: "WaitForSingleObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject non-crash dump requested" (Indicator: "WaitForSingleObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject process end" (Indicator: "WaitForSingleObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp")2b:T73f,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp")2c:T72f,"msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP") "msedgewebview2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP") "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY") "msedgewebview2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSEDGEWEBVIEW2.EXE") "msedgewebview2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86\XTAJIT") "msedgewebview2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001") "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001") "msedgewebview2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM") "msedgewebview2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS") "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS") "msedgewebview2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS") "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS") "msedgewebview2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES") "msedgewebview2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES") "msedgewebview2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES\MANIFESTEDMERGESTUBSDBS")2d:Ta8a,"msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3420030955 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3420037409 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3420294870 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3420301237 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3420520482 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3420527076 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3423411202 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3423417967 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3423783037 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3423789906 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3424183977 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3424190616 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3424500388 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3424507079 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3424845953 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3424852612 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3425436020 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3425442703 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3426491496 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3426498005 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3427430272 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3427437321 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3428683271 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3428689962 [PID: 6572] "msedgewebview2.exe" queried SystemProcessInformation at 00000000-00006572-00000C15-3431689061 [PID: 6572]2e:T1656,"msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-eccaa385-d549-424a-8f96-148c3e2a2bbf.tmp" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Local State" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache\wasm\index-dir\temp-index" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Site Characteristics Database\000001.dbtmp" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Site Characteristics Database\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension Rules\000001.dbtmp" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension Rules\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_proto_db\metadata\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\component_crx_cache\7aa00a64-f88b-4edf-a0f8-8cbee0b3943b.tmp" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\component_crx_cache\metadata.json" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_proto_db\000001.dbtmp" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_proto_db\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension Scripts\000001.dbtmp" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension Scripts\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\88530ea3-1d84-4492-86a8-4bd30e6eebc4.tmp" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Secure Preferences" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\2c9bf446-8dab-4854-ae9f-7e4c49574432.tmp" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Preferences" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension State\000001.dbtmp" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension State\CURRENT" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Shared Dictionary\cache\index-dir\temp-index" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\7c456974-d527-4809-864e-b2e9e99f2498.tmp" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\SCT Auditing Pending Reports" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\e79ff55a-db59-495f-abe8-dd02900ec933.tmp" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\Sdch Dictionaries" "msedgewebview2.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\483c491c-cc61-4bd9-a4da-ccaba1cad878.tmp" to "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\Network Persistent State"2f:T496,Process "WerFault.exe" [UID: 00000000-00007036] Process "WerFault.exe" [UID: 00000000-00004156] Process "WerFault.exe" [UID: 00000000-00007040] Process "WerFault.exe" [UID: 00000000-00002484] Process "WerFault.exe" [UID: 00000000-00003928] Process "WerFault.exe" [UID: 00000000-00004188] Process "WerFault.exe" [UID: 00000000-00004920] Process "WerFault.exe" [UID: 00000000-00002664] Process "WerFault.exe" [UID: 00000000-00001488] Process "WerFault.exe" [UID: 00000000-00007108] Process "WerFault.exe" [UID: 00000000-00008112] Process "WerFault.exe" [UID: 00000000-00002572] Process "WerFault.exe" [UID: 00000000-00000888] Process "WerFault.exe" [UID: 00000000-00006300] Process "WerFault.exe" [UID: 00000000-00001184] Process "WerFault.exe" [UID: 00000000-00001972] Process "WerFault.exe" [UID: 00000000-00001420] Process "WerFault.exe" [UID: 00000000-00007056] Process "WerFault.exe" [UID: 00000000-00004136] Process "WerFault.exe" [UID: 00000000-00007272] Process "WerFault.exe" [UID: 00000000-00005272] Process "WerFault.exe" [UID: 00000000-00007884] Process "WerFault.exe" [UID: 00000000-00007916] Process "WerFault.exe" [UID: 00000000-00000736]30:T1dfc,"msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "6N3Uy9nAUEqs5u96E/og0E/VJAg=" "cchString": "28" "dwFlags": "6" "pcbBinary": "14000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "6N3Uy9nAUEqs5u96E/og0E/VJAg=" "cchString": "28" "dwFlags": "6" "pcbBinary": "14000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "6N3Uy9nAUEqs5u96E/og0E/VJAg=" "cchString": "28" "dwFlags": "6" "pbBinary": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "pcbBinary": "14000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "6N3Uy9nAUEqs5u96E/og0E/VJAg=" "cchString": "28" "dwFlags": "6" "pbBinary": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "pcbBinary": "14000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "Qg7CkVSy3QE=" "cchString": "12" "dwFlags": "6" "pcbBinary": "08000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "Qg7CkVSy3QE=" "cchString": "12" "dwFlags": "6" "pcbBinary": "08000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "Qg7CkVSy3QE=" "cchString": "12" "dwFlags": "6" "pbBinary": "420ec29154b2dd01" "pcbBinary": "08000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "Qg7CkVSy3QE=" "cchString": "12" "dwFlags": "6" "pbBinary": "420ec29154b2dd01" "pcbBinary": "08000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "AAAAAA==" "cchString": "8" "dwFlags": "6" "pcbBinary": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "AAAAAA==" "cchString": "8" "dwFlags": "6" "pcbBinary": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "AAAAAA==" "cchString": "8" "dwFlags": "6" "pbBinary": "00000000" "pcbBinary": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "AAAAAA==" "cchString": "8" "dwFlags": "6" "pbBinary": "00000000" "pcbBinary": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MigAAAAACAAAAAAAQZgAAAAEAACAAAACJ9kvWZiLz3nTXjhasklC4TWyyJpHttS+xgYIefNBuYQAAAAAOgAAAAAIAACAAAAB86CWTn1gL/k9jAD/388jT6hNF59tHMaLUQkF2AFeuJzABAACIQV97VB1q9gLT7lO/fgrEaICv7mM5VoD4tSRN6Fx2ROZJ1ZK5U8WIswmZxw/h15KA" "cchString": "692" "dwFlags": "6" "pcbBinary": "06020000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MigAAAAACAAAAAAAQZgAAAAEAACAAAACJ9kvWZiLz3nTXjhasklC4TWyyJpHttS+xgYIefNBuYQAAAA" "cchString": "692" "dwFlags": "6" "pcbBinary": "06020000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MigAAAAACAAAAAAAQZgAAAAEAACAAAACJ9kvWZiLz3nTXjhasklC4TWyyJpHttS+xgYIefNBuYQAAAAAOgAAAAAIAACAAAAB86CWTn1gL/k9jAD/388jT6hNF59tHMaLUQkF2AFeuJzABAACIQV97VB1q9gLT7lO/fgrEaICv7mM5VoD4tSRN6Fx2ROZJ1ZK5U8WIswmZxw/h15KA" "cchString": "692" "dwFlags": "6" "pbBinary": "01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a321a7127555484b8be035c0b3cf8c8a0000000002000000000010660000000100002000000089f64bd66622f3de74d78e16ac9250b84d6cb22691edb52fb181821e7cd06e61000000000e80000000020000200000007ce825939f580bfe4f63003ff7f3c8d3ea1345e7db4731a2d44241760057ae273001000088415f7b541d6af602d3ee53bf7e0ac46880afee63395680f8b5244de85c7644e649d592b953c588b30999c70fe1d79280fa5881bb1aa15c1cc3557689a031f44b7833e70c1d5504e6ad33b4c14e1586bc015373d5b10eb164dbaaf89c453d02026814a7ca18ca49965a2a3f9ab21a692ced9114bae1ce3b474ff0e5c59e976e66019865029740215cf97bf1ec9f497d8fa0f239f2789cbbb336b15b4dc2469c21ab924b85e90192a381bcbd7cb9c7525f78e2d93d9b3688dc4142dd34ea0dffc777da3afcde572fcda49b6528d182f8e9d409340651495dee5573ae469dbc009eb3e08725e97ada72c9f89e4b8c9ec779035670892d1eab1080178b2b66a309646e242f32bd724af20dd1c0c59a0dd4f125f57cd767a991f4c219d57220f2e426adf7f24785a595492cff024170c9b9400000005aa1a2086f89ce99ea6ed95f0062cee7538c50ce53fa84a06258f3601fe43bc920c59a3cc69d865d8c6e3c65b3841b1dada9c4bb0f3b7b73160fa102581d441f" "pcbBinary": "06020000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAoyGnEnVVSEuL4DXAs8+MigAAAAACAAAAAAAQZgAAAAEAACAAAACJ9kvWZiLz3nTXjhasklC4TWyyJpHttS+xgYIefNBuYQAAAA" "cchString": "692" "dwFlags": "6" "pbBinary": "01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a321a7127555484b8be035c0b3cf8c8a0000000002000000000010660000000100002000000089f64bd66622f3de74d78e16ac9250b84d6cb22691edb52fb181821e7cd06e61000000000e80000000020000200000007ce825939f580bfe4f63003ff7f3c8d3ea1345e7db4731a2d44241760057ae273001000088415f7b541d6af602d3ee53bf7e0ac46880afee63395680f8b5244de85c7644e649d592b953c588b30999c70fe1d79280fa5881bb1aa15c1cc3557689a031f44b7833e70c1d5504e6ad33b4c14e1586bc015373d5b10eb164dbaaf89c453d02026814a7ca18ca49965a2a3f9ab21a692ced9114bae1ce3b474ff0e5c59e976e66019865029740215cf97bf1ec9f497d8fa0f239f2789cbbb336b15b4dc2469c21ab924b85e90192a381bcbd7cb9c7525f78e2d93d9b3688dc4142dd34ea0dffc777da3afcde572fcda49b6528d182f8e9d409340651495dee5573ae469dbc009eb3e08725e97ada72c9f89e4b8c9ec779035670892d1eab1080178b2b66a309646e242f32bd724af20dd1c0c59a0dd4f125f57cd767a991f4c219d57220f2e426adf7f24785a595492cff024170c9b9400000005aa1a2086f89ce99ea6ed95f0062cee7538c50ce53fa84a06258f3601fe43bc920c59a3cc69d865d8c6e3c65b3841b1dada9c4bb0f3b7b73160fa102581d441f" "pcbBinary": "06020000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "cchString": "40" "dwFlags": "8" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "cchString": "40" "dwFlags": "8" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "cchString": "40" "dwFlags": "8" "pbBinary": "Z*pX" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "cchString": "40" "dwFlags": "8" "pbBinary": "Z*pX" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "b943fb00c99a258e5f0873d8b450efdbd4065be2" "cchString": "40" "dwFlags": "8" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "b943fb00c99a258e5f0873d8b450efdbd4065be2" "cchString": "40" "dwFlags": "8" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "b943fb00c99a258e5f0873d8b450efdbd4065be2" "cchString": "40" "dwFlags": "8" "pbBinary": "b943fb00c99a258e5f0873d8b450efdbd4065be2" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryW" with parameters {"pszString": "b943fb00c99a258e5f0873d8b450efdbd4065be2" "cchString": "40" "dwFlags": "8" "pbBinary": "b943fb00c99a258e5f0873d8b450efdbd4065be2" "pcbBinary": "14000000" "pdwFlags": "04000000"} "msedgewebview2.exe" called "CryptStringToBinaryA" with parameters {"pszString": "ce1dca8a9cdc2f790f3d2506ef7f093e1f0fd27a" "cchString": "40" "dwFlags": "8" "pcbBinary": "14000000" "pdwFlags": "04000000"}31:T437,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to access crypto-related API (String) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Able to decrypt/decode data Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to performs encryption on the data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match - AES encryption32:T76d,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp")33:T452,Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp")34:T638,Found system information discovery API: "GetEnvironmentStringsW" in file "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" Found system information discovery API: "GetSystemInfo" in file "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation SystemExtendedHandleInformation" in "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp" Found system information discovery API: "::NtQuerySystemInformation" in "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp"35:Tc04b,Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00006572-00000C2C-3421424978") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00006572-00000C2C-3422500038") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00006572-00000C2C-3431548481") Found reference to API "*/(function(e){function t(C,P){var z=C.length;C.push(P);e:for(;0>>1,Z=C[Q];if(0>>1;Ql(kl,z))ytl(er,kl)?(C[Q]=er,C[yt]=z,Q=yt):(C[Q]=kl,C[vt]=z,Q=vt);else if(ytl(er,z))C[Q]=er,C[yt]=z,Q=yt;else break e}}return P}function l(C,P){var z=C.sortIndex-P.sortIndex;return z!==0?z:C.id-P.id}if(typeof performance=="object"&&typeof performance.now=="function"){var i=performance;e.unstable_now=function(){return i.now()}}else{var u=Date,o=u.now();e.unstable_now=function(){return u.now()-o}}var s=[],a=[],m=1,v=null,h=3,w=!1,S=!1,E=!1,D=typeof setTimeout=="function"?setTimeout:null,d=typeof clearTimeout=="function"?clearTimeout:null,c=typeof setImmediate<"u"?setImmediate:null;typeof navigator<"u"&&navigator.scheduling!==void 0&&navigator.scheduling.isInputPending!==void 0&&navigator.scheduling.isInputPending.bind(navigator.scheduling);function p(C){for(var P=n(a);P!==null;){if(P.callback===null)r(a);else if(P.startTime<=C)r(a),P.sortIndex=P.expirationTime,t(s,P);else break;P=n(a)}}function y(C){if(E=!1,p(C),!S)if(n(s)!==null)S=!0,wl(k);else{var P=n(a);P!==null&&Sl(y,P.startTime-C)}}function k(C,P){S=!1,E&&(E=!1,d(j),j=-1),w=!0;var z=h;try{for(p(P),v=n(s);v!==null&&(!(v.expirationTime>P)||C&&!je());){var Q=v.callback;if(typeof Q=="function"){v.callback=null,h=v.priorityLevel;var Z=Q(v.expirationTime<=P);P=e.unstable_now(),typeof Z=="function"?v.callback=Z:v===n(s)&&r(s),p(P)}else r(s);v=n(s)}if(v!==null)var bn=!0;else{var vt=n(a);vt!==null&&Sl(y,vt.startTime-P),bn=!1}return bn}finally{v=null,h=z,w=!1}}var x=!1,_=null,j=-1,H=5,L=-1;function je(){return!(e.unstable_now()-LC||125Q?(C.sortIndex=z,t(a,C),n(s)===null&&C===n(a)&&(E?(d(j),j=-1):E=!0,Sl(y,z-Q))):(C.sortIndex=Z,t(s,C),S||w||(S=!0,wl(k))),C},e.unstable_shouldYield=je,e.unstable_wrapCallback=function(C){var P=h;return function(){var z=h;h=P;try{return C.apply(this,arguments)}finally{h=z}}}})(os);us.exports=os;var Mc=us.exports;/**" (Indicator: "postmessage"; Source: "00000000-00002160.00000000.305187.00198000.00000004.mdmp, 00000000-00002160.00000000.305187.00A04000.00000004.mdmp") Found reference to API "window.external={invoke:s=>window.chrome.webview.postMessage(s)}" (Indicator: "postmessage"; Source: "00000000-00002160.00000000.305187.00204000.00000004.mdmp, 00000000-00002160.00000002.309025.00204000.00000004.mdmp") Found reference to API "(()=>{var j=Object.defineProperty;var p=(e,t)=>{for(var n in t)j(e,n,{get:t[n],enumerable:!0})};var b={};p(b,{LogDebug:()=>$,LogError:()=>Q,LogFatal:()=>_,LogInfo:()=>Y,LogLevel:()=>K,LogPrint:()=>X,LogTrace:()=>J,LogWarning:()=>q,SetLogLevel:()=>Z});function u(e,t){window.WailsInvoke("L"+e+t)}function J(e){u("T",e)}function X(e){u("P",e)}function $(e){u("D",e)}function Y(e){u("I",e)}function q(e){u("W",e)}function Q(e){u("E",e)}function _(e){u("F",e)}function Z(e){u("S",e)}var K={TRACE:1,DEBUG:2,INFO:3,WARNING:4,ERROR:5};var y=class{constructor(t,n,o){this.eventName=t,this.maxCallbacks=o||-1,this.Callback=i=>(n.apply(null,i),this.maxCallbacks===-1?!1:(this.maxCallbacks-=1,this.maxCallbacks===0))}},w={};function v(e,t,n){w[e]=w[e]||[];let o=new y(e,t,n);return w[e].push(o),()=>ee(o)}function W(e,t){return v(e,t,-1)}function A(e,t){return v(e,t,1)}function P(e){let t=e.name,n=w[t]?.slice()||[];if(n.length){for(let o=n.length-1;o>=0;o-=1){let i=n[o],r=e.data;i.Callback(r)&&n.splice(o,1)}n.length===0?g(t):w[t]=n}}function F(e){let t;try{t=JSON.parse(e)}catch{let o="Invalid JSON passed to Notify: "+e;throw new Error(o)}P(t)}function R(e){let t={name:e,data:[].slice.apply(arguments).slice(1)};P(t),window.WailsInvoke("EE"+JSON.stringify(t))}function g(e){delete w[e],window.WailsInvoke("EX"+e)}function x(e,...t){g(e),t.length>0&&t.forEach(n=>{g(n)})}function M(){Object.keys(w).forEach(t=>{g(t)})}function ee(e){let t=e.eventName;w[t]!==void 0&&(w[t]=w[t].filter(n=>n!==e),w[t].length===0&&g(t))}var c={};function te(){var e=new Uint32Array(1);return window.crypto.getRandomValues(e)[0]}function ne(){return Math.random()*9007199254740991}var D;window.crypto?D=te:D=ne;function a(e,t,n){return n==null&&(n=0),new Promise(function(o,i){var r;do r=e+"-"+D();while(c[r]);var l;n>0&&(l=setTimeout(function(){i(Error("Call to "+e+" timed out. Request ID: "+r))},n)),c[r]={timeoutHandle:l,reject:i,resolve:o};try{let d={name:e,args:t,callbackID:r};window.WailsInvoke("C"+JSON.stringify(d))}catch(d){console.error(d)}})}window.ObfuscatedCall=(e,t,n)=>(n==null&&(n=0),new Promise(function(o,i){var r;do r=e+"-"+D();while(c[r]);var l;n>0&&(l=setTimeout(function(){i(Error("Call to method "+e+" timed out. Request ID: "+r))},n)),c[r]={timeoutHandle:l,reject:i,resolve:o};try{let d={id:e,args:t,callbackID:r};window.WailsInvoke("c"+JSON.stringify(d))}catch(d){console.error(d)}}));function z(e){let t;try{t=JSON.parse(e)}catch(i){let r=`Invalid JSON passed to callback: ${i.message}. Message: ${e}`;throw runtime.LogDebug(r),new Error(r)}let n=t.callbackid,o=c[n];if(!o){let i=`Callback '${n}' not registered!!!`;throw console.error(i),new Error(i)}clearTimeout(o.timeoutHandle),delete c[n],t.error?o.reject(t.error):o.resolve(t.result)}window.go={};function B(e){try{e=JSON.parse(e)}catch(t){console.error(t)}window.go=window.go||{},Object.keys(e).forEach(t=>{window.go[t]=window.go[t]||{},Object.keys(e[t]).forEach(n=>{window.go[t][n]=window.go[t][n]||{},Object.keys(e[t][n]).forEach(o=>{window.go[t][n][o]=function(){let i=0;function r(){let l=[].slice.call(arguments);return a([t,n,o].join("."),l,i)}return r.setTimeout=function(l){i=l},r.getTimeout=function(){return i},r}()})})})}var T={};p(T,{WindowCenter:()=>ae,WindowFullscreen:()=>de,WindowGetPosition:()=>xe,WindowGetSize:()=>pe,WindowHide:()=>De,WindowIsFullscreen:()=>ue,WindowIsMaximised:()=>Te,WindowIsMinimised:()=>Ce,WindowIsNormal:()=>Ie,WindowMaximise:()=>Ee,WindowMinimise:()=>Se,WindowReload:()=>oe,WindowReloadApp:()=>ie,WindowSetAlwaysOnTop:()=>ve,WindowSetBackgroundColour:()=>Oe,WindowSetDarkTheme:()=>le,WindowSetLightTheme:()=>se,WindowSetMaxSize:()=>ge,WindowSetMinSize:()=>me,WindowSetPosition:()=>We,WindowSetSize:()=>ce,WindowSetSystemDefaultTheme:()=>re,WindowSetTitle:()=>we,WindowShow:()=>he,WindowToggleMaximise:()=>be,WindowUnfullscreen:()=>fe,WindowUnmaximise:()=>ye,WindowUnminimise:()=>ke});function oe(){window.location.reload()}function ie(){window.WailsInvoke("WR")}function re(){window.WailsInvoke("WASDT")}function se(){window.WailsInvoke("WALT")}function le(){window.WailsInvoke("WADT")}function ae(){window.WailsInvoke("Wc")}function we(e){window.WailsInvoke("WT"+e)}function de(){window.WailsInvoke("WF")}function fe(){window.WailsInvoke("Wf")}function ue(){return a(":wails:WindowIsFullscreen")}function ce(e,t){window.WailsInvoke("Ws:"+e+":"+t)}function pe(){return a(":wails:WindowGetSize")}function ge(e,t){window.WailsInvoke("WZ:"+e+":"+t)}function me(e,t){window.WailsInvoke("Wz:"+e+":"+t)}function ve(e){window.WailsInvoke("WATP:"+(e?"1":"0"))}function We(e,t){window.WailsInvoke("Wp:"+e+":"+t)}function xe(){return a(":wails:WindowGetPos")}function De(){window.WailsInvoke("WH")}function he(){window.WailsInvoke("WS")}function Ee(){window.WailsInvoke("WM")}function be(){window.WailsInvoke("Wt")}function ye(){window.WailsInvoke("WU")}function Te(){return a(":wails:WindowIsMaximised")}function Se(){window.WailsInvoke("Wm")}function ke(){window.WailsInvoke("Wu")}function Ce(){return a(":wails:WindowIsMinimised")}function Ie(){return a(":wails:WindowIsNormal")}function Oe(e,t,n,o){let i=JSON.stringify({r:e||0,g:t||0,b:n||0,a:o||255});window.WailsInvoke("Wr:"+i)}var S={};p(S,{ScreenGetAll:()=>Le});function Le(){return a(":wails:ScreenGetAll")}var k={};p(k,{BrowserOpenURL:()=>Ae});function Ae(e){window.WailsInvoke("BO:"+e)}var C={};p(C,{ClipboardGetText:()=>Fe,ClipboardSetText:()=>Pe});function Pe(e){return a(":wails:ClipboardSetText",[e])}function Fe(){return a(":wails:ClipboardGetText")}var I={};p(I,{CanResolveFilePaths:()=>V,OnFileDrop:()=>Me,OnFileDropOff:()=>ze,ResolveFilePaths:()=>Re});var s={registered:!1,defaultUseDropTarget:!0,useDropTarget:!0,nextDeactivate:null,nextDeactivateTimeout:null},m="wails-drop-target-active";function h(e){let t=e.getPropertyValue(window.wails.flags.cssDropProperty).trim();return t?t===window.wails.flags.cssDropValue:!1}function G(e){if(!e.dataTransfer.types.includes("Files")||(e.preventDefault(),e.dataTransfer.dropEffect="copy",!window.wails.flags.enableWailsDragAndDrop)||!s.useDropTarget)return;let n=e.target;if(s.nextDeactivate&&s.nextDeactivate(),!n||!h(getComputedStyle(n)))return;let o=n;for(;o;)h(getComputedStyle(o))&&o.classList.add(m),o=o.parentElement}function H(e){if(!!e.dataTransfer.types.includes("Files")&&(e.preventDefault(),!!window.wails.flags.enableWailsDragAndDrop&&!!s.useDropTarget)){if(!e.target||!h(getComputedStyle(e.target)))return null;s.nextDeactivate&&s.nextDeactivate(),s.nextDeactivate=()=>{Array.from(document.getElementsByClassName(m)).forEach(n=>n.classList.remove(m)),s.nextDeactivate=null,s.nextDeactivateTimeout&&(clearTimeout(s.nextDeactivateTimeout),s.nextDeactivateTimeout=null)},s.nextDeactivateTimeout=setTimeout(()=>{s.nextDeactivate&&s.nextDeactivate()},50)}}function U(e){if(!!e.dataTransfer.types.includes("Files")&&(e.preventDefault(),!!window.wails.flags.enableWailsDragAndDrop)){if(V()){let n=[];e.dataTransfer.items?n=[...e.dataTransfer.items].map((o,i)=>{if(o.kind==="file")return o.getAsFile()}):n=[...e.dataTransfer.files],window.runtime.ResolveFilePaths(e.x,e.y,n)}!s.useDropTarget||(s.nextDeactivate&&s.nextDeactivate(),Array.from(document.getElementsByClassName(m)).forEach(n=>n.classList.remove(m)))}}function V(){return window.chrome?.webview?.postMessageWithAdditionalObjects!=null}function Re(e,t,n){window.chrome?.webview?.postMessageWithAdditionalObjects&&chrome.webview.postMessageWithAdditionalObjects(`file:drop:${e}:${t}`,n)}function Me(e,t){if(typeof e!="function"){console.error("DragAndDropCallback is not a function");return}if(s.registered)return;s.registered=!0;let n=typeof t;s.useDropTarget=n==="undefined"||n!=="boolean"?s.defaultUseDropTarget:t,window.addEventListener("dragover",G),window.addEventListener("dragleave",H),window.addEventListener("drop",U);let o=e;s.useDropTarget&&(o=function(i,r,l){let d=document.elementFromPoint(i,r);if(!d||!h(getComputedStyle(d)))return null;e(i,r,l)}),W("wails:file-drop",o)}function ze(){window.removeEventListener("dragover",G),window.removeEventListener("dragleave",H),window.removeEventListener("drop",U),x("wails:file-drop"),s.registered=!1}function N(e){let t=e.target;switch(window.getComputedStyle(t).getPropertyValue("--default-contextmenu").trim()){case"show":return;case"hide":e.preventDefault();return;default:if(t.isContentEditable)return;let i=window.getSelection(),r=i.toString().length>0;if(r)for(let l=0;l{if(window.wails.flags.resizeEdge){window.WailsInvoke("resize:"+window.wails.flags.resizeEdge),e.preventDefault();return}if(Ne(e)){if(window.wails.flags.disableScrollbarDrag&&(e.offsetX>e.target.clientWidth||e.offsetY>e.target.clientHeight))return;window.wails.flags.deferDragToMouseMove?window.wails.flags.shouldDrag=!0:(e.preventDefault(),window.WailsInvoke("drag"));return}else window.wails.flags.shouldDrag=!1});window.addEventListener("mouseup",()=>{window.wails.flags.shouldDrag=!1});function f(e){document.documentElement.style.cursor=e||window.wails.flags.defaultCursor,window.wails.flags.resizeEdge=e}window.addEventListener("mousemove",function(e){if(window.wails.flags.shouldDrag&&(window.wails.flags.shouldDrag=!1,(e.buttons!==void 0?e.buttons:e.which)>0)){window.WailsInvoke("drag");return}if(!window.wails.flags.enableResize)return;window.wails.flags.defaultCursor==null&&(window.wails.flags.defaultCursor=document.documentElement.style.cursor),window.outerWidth-e.clientX{if(window.EmbeddedBrowserWebView){window.chrome||(window.chrome={});const e=window.EmbeddedBrowserWebView,t=window.gc,r=globalParams.sdkVersion<=2,s=globalParams.sdkVersion>=7,o=globalParams.useNativeEvent,a=globalParams.logNativeEvent,i=globalParams.useTextureStream,n=globalParams.usePostMessageWithAdditionalObjects;if(delete window.EmbeddedBrowserWebView,delete window.gc,delete globalParams,window.top===window||s){function copyObject(e){let t=function copiedObject(...t){return new e(...t)};return window.Object.getOwnPropertyNames(e).concat(window.Object.getOwnPropertySymbols(e)).forEach((r=>{let s=e[r];"function"==typeof s&&(s=s.bind(e)),t[r]=s})),t}const c=copyObject(window.Object),l=copyObject(window.Promise),p=copyObject(window.JSON),h=copyObject(window.console),d=copyObject(window.EventTarget),u=copyObject(window.Proxy),_=copyObject(window.FinalizationRegistry),m=copyObject(window.Set);function delayPropertyCreation(e,t,r){c.defineProperty(e,t,{configurable:!0,enumerable:!0,get:()=>{const s=r();return c.defineProperty(e,t,{configurable:!0,enumerable:!0,writable:!0,value:s}),s}})}delayPropertyCreation(chrome,"webview",(function createChromeWebView(){class LocalRefTracker{constructor(e){this._idToCallback={},this._nextId=1,this._log=e,this._group=null,_&&(this._group=new _(this._cleanup.bind(this)))}_cleanup(e){e&&this._idToCallback[e]&&(this._log("cleanup for "+e),this._idToCallback[e](),delete this._idToCallback[e])}watchForRelease(e,t){if(this._group){const r=this._nextId++,s=e._debugId?.join(" ")||e._debugId;this._log("watching for cleanup of "+r+" ("+s+")"),this._idToCallback[r]=t,this._group.register(e,r)}}cleanupSome(){return t&&(async()=>{await t({type:"full",heap:"all",flags:["force"],execution:"async"})})(),!0}}class ParamTracker{constructor(){this._paramTracker={},this._cleanupRegistry=null,_&&(this._cleanupRegistry=new _((e=>{this.removeParams(e)})))}setParams(e,t){t&&t.length&&(this._paramTracker[e]=t)}getParams(e){return this._paramTracker[e]}hasParams(e){return void 0!==this._paramTracker[e]}removeParams(e){delete this._paramTracker[e]}bindParamsToObjectLifetime(e,t){this._cleanupRegistry&&t&&this._cleanupRegistry.register(e,t)}updateArrayParams(e,t,r){if(t&&r&&this.hasParams(e)){const s=this.getParams(e);for(let e=0;ethis._maxRemoteSequenceId&&(this._maxRemoteSequenceId=e)}addReference(e){null!=e?this._mapRemoteIdToRefCount.hasOwnProperty(e)?++this._mapRemoteIdToRefCount[e]:this._mapRemoteIdToRefCount[e]=1:h.assert(!1,"invalid remoteId in addReference:"+e)}removeReference(e){if(null==e)return void h.assert(!1,"invalid remoteId in removeReference:"+e);h.assert(this._mapRemoteIdToRefCount.hasOwnProperty(e));0===--this._mapRemoteIdToRefCount[e]&&(delete this._mapRemoteIdToRefCount[e],this._releaseObjectsCallback&&(this._releaseObjectsCallback(this._maxRemoteSequenceId,p.stringify([e])),this._log("Sending remote release message "+e)))}}class IdGenerator{constructor(){this._nextId=1}getNextId(){return this._nextId++}}class Deferral{constructor(){let e=this.controls={clear:function(){e.resolve=e.reject=e.clear=function(){},e=null}};this.promise=new l(((t,r)=>{this.controls.resolve=function deferralResolve(...r){const s=t.apply(null,r);return e.clear(),s},this.controls.reject=function deferralReject(...t){const s=r.apply(null,t);return e.clear(),s}}))}}class ObjectSerializer{constructor(e,t,r,s){this._idGenerator=e,this._groupId=t,this._proxyOptions=r,this._proxyOptionsSymbol=Symbol("EmbeddedBrowserWebView.proxyOptions"),this._options=s,this._serializationOptionsPropertyName="1B9FCAB5-FB86-4D78-91DE-7BC2B4077E5B",this._objectIdToObject={},this._paramTracker=new ParamTracker,this._skipPropertyNames=["name","length","arguments","caller"]}_getProxyOptions(e){return e&&e.hasOwnProperty(this._proxyOptionsSymbol)?e[this._proxyOptionsSymbol]:null}_hasProxyOptions(e){return null!==this._getProxyOptions(e)}_setProxyOptions(e,t){c.defineProperty(e,this._proxyOptionsSymbol,{value:t,configurable:!0})}_getOrCreateProxyOptions(e){let t=this._getProxyOptions(e);if(!t){const r=this._idGenerator.getNextId();t={remoteObjectId:r,groupId:this._groupId,type:"proxy",remoteSequenceId:0},this._setProxyOptions(e,t),this._objectIdToObject[r]=e}return t}_updateSequenceNumberForProxyOptions(e,t){h.assert(e),e.groupId===this._groupId&&(h.assert(e.remoteSequenceId<=t),e.remoteSequenceId=t)}getObjectByObjectId(e){return this._objectIdToObject[e]}setObjectProxyOptionsFromResponse(e,t){this._setProxyOptions(e,t.parameters.result[this._serializationOptionsPropertyName])}setObjectByWellKnownObjectId(e,t){h.assert(t<1),this._objectIdToObject[t]=e}getObjectIdBySerializedObjectMessage(e){let t=null;return e&&e.parameters&&e.parameters.result&&e.parameters.result.hasOwnProperty(this._serializationOptionsPropertyName)&&(t=e.parameters.result[this._serializationOptionsPropertyName].remoteObjectId,void 0===t&&(t=null)),t}getHostKeyNamesBySerializedObjectMessage(e){let t=[];return e&&e.parameters&&e.parameters.result&&e.parameters.result.hasOwnProperty(this._serializationOptionsPropertyName)&&(t=e.parameters.result[this._serializationOptionsPropertyName].hostKeyNames||[]),t}updateSequenceNumberFromSerializedObjectMessage(e){if(e&&e.parameters&&e.parameters.result&&e.parameters.result.hasOwnProperty(this._serializationOptionsPropertyName)){const t=e.parameters.result[this._serializationOptionsPropertyName];t.seq_no&&this._proxyOptions.remoteRefTracker.addSequenceId(t.seq_no)}}releaseObjects(e,t){for(const r of t){const t=this.getObjectByObjectId(r);if(t){const s=this._getProxyOptions(t);s&&s.remoteSequenceId<=e&&(delete t[this._proxyOptionsSymbol],delete this._objectIdToObject[r])}}}getAndClearIsCacheableBySerializedObjectMessage(e){let t=!1;return e&&e.parameters&&(t=e.parameters.cache_able,delete e.parameters.cache_able,!t&&e.parameters.result&&e.parameters.result.hasOwnProperty(this._serializationOptionsPropertyName)&&(t=e.parameters.result[this._serializationOptionsPropertyName].cache_able,delete e.parameters.result[this._serializationOptionsPropertyName].cache_able)),t}serialize(e,t){try{const r=this;return p.stringify(e,(function(e,s){let o=s;if("function"==typeof s||r._hasProxyOptions(s)){let a=r._getOrCreateProxyOptions(s);if(r._updateSequenceNumberForProxyOptions(a,t),o={},o[r._serializationOptionsPropertyName]=a,"toString"===e)try{o.value=s()}catch(e){}}else r._options.shouldSerializeDates&&this[e]instanceof Date?o={[r._serializationOptionsPropertyName]:{type:"date"},value:this[e].getTime()}:void 0===s&&(o=null);return o}))}catch(e){throw e}}deserialize(e,t,r,s){let o=s?s[this._serializationOptionsPropertyName]:null;return o&&o.type&&"date"==o.type?this._options.shouldSerializeDates?new Date(s.value.jsTime):s.value.date:t?p.parse(p.stringify(s),((s,o)=>{let a=o,i=o&&o[this._serializationOptionsPropertyName];if(i)if(i.remoteObjectId&&i.groupId!==this._groupId){let n,l,p,d,u;if(i.seq_no&&this._proxyOptions.remoteRefTracker.addSequenceId(i.seq_no),i.scriptBehavior)switch(i.scriptBehavior){case 1:n={},c.getOwnPropertyNames(Array.prototype).concat(c.getOwnPropertySymbols(Array.prototype)).filter((e=>"length"!=e)).forEach((e=>{n[e]=Array.prototype[e]})),n[Symbol.isConcatSpreadable]=!0,l=function(){const e=this.getHostProperty("length");if(void 0===this._arrayPropertyNames&&(this._arrayPropertyNames=[]),this._arrayPropertyNames.length>e)this._arrayPropertyNames.length=e;else if(this._arrayPropertyNames.length"length"!=e)).forEach((t=>{n[t]=e[t]})),n[Symbol.isConcatSpreadable]=!0}else{switch(typeof n){case"string":n=new String(n),s=["toString","valueOf"];break;case"boolean":n=new Boolean(n),s=["toString","valueOf"];break;case"number":n=new Number(n),s=["toExponential","toFixed","toLocaleString","toPrecision","toString","valueOf"]}s.forEach((e=>n[e]=n[e].bind(n))),n[Symbol.isConcatSpreadable]=!1}}l||(l=i.hostKeyNames?this.deserialize(e,t,r,i.hostKeyNames):[]),p||(p=i.hostPrecacheProperties?this.deserialize(e,t,r,i.hostPrecacheProperties):[]),d||i.outArrayResult&&(d=this.deserialize(e,t,r,i.outArrayResult)),u||i.outArrayIndex&&(u=i.outArrayIndex);const _=!!s;if(a=this.createKnownRemoteProxy(i.remoteObjectId,_,e,r,n,l),this._setProxyOptions(a,i),p)for(const[e,t]of c.entries(p))this._proxyOptions.objectSerializer._skipPropertyNames.includes(e)||a.setLocalProperty(e,t);d&&u&&this._proxyOptions.objectSerializer._paramTracker.updateArrayParams(o.callId,d,u)}else i.remoteObjectId?(h.assert(i.groupId===this._groupId),h.assert(this._objectIdToObject.hasOwnProperty(i.remoteObjectId)),a=this._objectIdToObject[i.remoteObjectId]):"undefined"===i.type&&(a=void 0);return a})):s}deserializeArray(e,t,r,s){return s.map(this.deserialize.bind(this,e,t,r))}createKnownRemoteProxy(e,t,r,s,o,a){const i={};i[this._serializationOptionsPropertyName]={remoteObjectId:e};const n={remoteObjectId:e,parameters:{result:i}};let c=null;return c=r?new SyncRemoteProxy(this._proxyOptions,n,s,a):new KnownAsyncRemoteProxy(this._proxyOptions,t,n,s,a),c.createPublicObject(o)}}class RemoteMessenger{constructor(e,t,r,s,o){this._postRemoteObjectCall=e,this._log=r,this._idGenerator=s,this._objectSerializer=o,this._callIdToDetails={},t&&(t.addEventListener("remoteproxycall",(e=>{this._handleRemoteProxyCallEvent(e.data)})),t.addEventListener("remoteproxyrelease",(e=>{this._handleRemoteProxyReleaseEvent(e.data)})))}_setNativeRemoteObjectEventTarget(e){e.addEventListener("remoteproxycall",(e=>{this._handleRemoteProxyCallEvent(p.parse(e.data))})),e.addEventListener("remoteproxyrelease",(e=>{this._handleRemoteProxyReleaseEvent(p.parse(e.data))}))}_handleRemoteProxyCallEvent(e){this._log("remoteproxycall event",e),"request"===e.parameters.kind?this._handleRequest(e):(h.assert("response"===e.parameters.kind),this._handleResponse(e))}_handleRemoteProxyReleaseEvent(e){this._log("remoteproxyrelease event",e),this._handleReleaseObjects(e)}_postRemoteProxyMessage(e,t,r,s,o){this._log("post remote message",{remoteObjectId:e,methodName:t,parameters:r,callId:s,sync:o});const a=this._postRemoteObjectCall(e,t,this._objectSerializer.serialize(r,s),s,o?1:0);return o&&a&&this._log("sync remote message response",a),a}postSyncRequestMessage(e,t,r,s,o){const a=this._idGenerator.getNextId(),i=this.GetTypedArrayParametersIndices(s),n=this._postRemoteProxyMessage(e,t,{kind:"request",options:{operation:r,typedArrayIndices:i},parameters:s},a,!0);if(!n.parameters)throw new Error("No parameters in result: "+p.stringify(n,null,1));if(n.parameters.error){const e=this._objectSerializer.deserialize(!0,!1,o,n.parameters.error);if(!!chrome.webview.hostObjects.getLocalProperty("options")?.ignoreMemberNotFoundError&&(e.includes("0x80020003")||e.includes("0x80020006")))return{value:void 0,cache_able:!1};throw new Error(e)}{const e=this._objectSerializer.getAndClearIsCacheableBySerializedObjectMessage(n);s&&s.length&&n.parameters&&n.parameters.result&&n.parameters.result.hasOwnProperty(this._objectSerializer._serializationOptionsPropertyName)&&(this._objectSerializer._paramTracker.setParams(a,s),n.parameters.result.callId=a);const t={value:this._objectSerializer.deserialize(!0,n.parameters.has_object,o,n.parameters.result),cache_able:e};return this._objectSerializer._paramTracker.removeParams(a),t}}postRequestMessage(e,t,r,s){const o=this._idGenerator.getNextId(),a=this._callIdToDetails[o]={},i=new Deferral;a.deferral=i.controls,s&&s.length&&this._objectSerializer._paramTracker.setParams(o,s);const n=this.GetTypedArrayParametersIndices(s);return this._postRemoteProxyMessage(e,t,{kind:"request",options:{operation:r,typedArrayIndices:n},parameters:s},o),i.promise._callId=o,i.promise}_postResponseMessage(e,t,r){if(0!=e.callId){const s={kind:"response"};t?s.result=r:s.error=r,this._postRemoteProxyMessage(0,"",s,e.callId)}}_handleRequest(e){h.assert("request"===e.parameters.kind);const t=!!chrome.webview.hostObjects.getLocalProperty("options")?.defaultSyncProxy,r=this._objectSerializer.deserializeArray(t,e.parameters.has_object,"request",e.parameters.parameters),s=this._objectSerializer.getObjectByObjectId(e.remoteObjectId);try{let t;switch(e.parameters.options.operation){case"get":t=s[e.methodName];break;case"set":t=s[e.methodName]=r[0];break;case"apply":t=(e.methodName?s[e.methodName]:s).apply(null,r)}t&&t.then?t.then((t=>this._postResponseMessage(e,!0,t)),(t=>this._postResponseMessage(e,!1,t))):this._postResponseMessage(e,!0,t)}catch(t){this._postResponseMessage(e,!1,t)}}_handleResponse(e){h.assert("response"===e.parameters.kind),h.assert(void 0!==e.parameters.error||void 0!==e.parameters.result,"response data should have either error or result");const t=this._callIdToDetails[e.callId];delete this._callIdToDetails[e.callId],h.assert(t,"no call detail for "+e.callId),void 0!==t&&(e.parameters.error?t.deferral.reject(e):t.deferral.resolve(e))}_handleReleaseObjects(e){h.assert(e.sequence_number),h.assert(e.object_ids_array),this._objectSerializer.releaseObjects(e.sequence_number,e.object_ids_array)}GetTypedArrayParametersIndices(e){let t=[];if(this._objectSerializer._options.shouldPassTypedArraysAsArrays)for(let r=0;rt.add(e)));return t.add("_callId"),t.add("_shouldCancel"),t}_isLocalProperty(e){return"symbol"==typeof e||this._innerPropertyNames.has(e)||this._forceLocalProperties.has(e)}getLocalProperty(e){return this[e]}setLocalProperty(e,t){return this._innerPropertyNames.add(e),this[e]=t}_getAmbiguous(e){return this._forceRemoteProperties.has(e)?this.getForceRemoteProperty(e):this._isLocalProperty(e)?this.getLocalProperty(e):this.getHostProperty(e)}_setAmbiguous(e,t){return this._forceRemoteProperties.has(e)?this.setForceRemoteProperty(e,t):this._isLocalProperty(e)?this.setLocalProperty(e,t):this.setHostProperty(e,t)}_ownKeys(){let e=("function"==typeof this._hostKeyNames?this._hostKeyNames():this._hostKeyNames)||[],t=c.getOwnPropertyDescriptors(this),r=c.keys(t).filter((e=>!t[e].configurable));return e=e.concat(r),e}_getOwnPropertyDescriptor(e){return("function"==typeof this._hostKeyNames?this._hostKeyNames():this._hostKeyNames)?.includes(e)?{writable:!0,configurable:!0,enumerable:!0}:Reflect.getOwnPropertyDescriptor(this,e)}_cancel(){const e=this._callId;e?(this._options.remoteMessenger.postRequestMessage(this._remoteObjectId,""+e,"cancel",[]),e in this._options.remoteMessenger._callIdToDetails&&this._options.remoteMessenger._callIdToDetails[e].deferral.reject(new Error("Promise canceled"))):this._shouldCancel=!0}overwriteTargetObject(e){const t=["_then","_catch","_isLocalProperty","_tryCacheResult","_ownKeys","_getOwnPropertyDescriptor","async","sync","_getAmbiguous","_setAmbiguous","getLocalProperty","setLocalProperty","getHostProperty","setHostProperty","getForceRemoteProperty","setForceRemoteProperty","applyHostFunction","overwriteTargetObject","createPublicObject","_callId","_shouldCancel","_cancel"].concat(c.keys(this)),s={getLocalProperty:"getLocal",setLocalProperty:"setLocal",getHostProperty:"getRemote",setHostProperty:"setRemote",applyHostFunction:"applyRemote"};t.forEach((t=>{const o=this[t];if(void 0===o?delete e[t]:"function"==typeof o?e[t]=this[t].bind(e):void 0!==o&&(e[t]=this[t]),r&&o){const r=s[t];r&&(e[r]=e[t])}})),e._thenable&&(e.then=e._then,e.catch=e._catch),e._innerPropertyNames=RemoteProxy._getPropertyNames(e),this._redirectedThis=e}createPublicObject(e){e=e||function CallableTarget(){},this.overwriteTargetObject(e);const t=new u(e,{apply:(e,t,r)=>e.applyHostFunction(r),get:(e,t,r)=>e._getAmbiguous(t),set:(e,t,r)=>(e._setAmbiguous(t,r),!0),defineProperty:(e,t,r)=>(e._innerPropertyNames.add(t),c.defineProperty(e,t,r)),construct:(e,t)=>e.applyHostFunction(t),ownKeys:e=>e._ownKeys(),getOwnPropertyDescriptor:(e,t)=>e._getOwnPropertyDescriptor(t),has:(e,t)=>void 0!==e._getOwnPropertyDescriptor(t)});return t}_tryCacheResult(e,t,r){if(this._options.objectSerializer.getAndClearIsCacheableBySerializedObjectMessage(r)){const s=this._options.objectSerializer.deserialize(e,r.parameters.has_object,this._debugId.concat(t),r.parameters.result);this._options.objectSerializer._skipPropertyNames.includes(t)||this.setLocalProperty(t,s),this._options.objectSerializer._paramTracker.removeParams(r.callId)}}}class AsyncRemoteProxy extends RemoteProxy{constructor(e,t,r,s,o,a){super(e,t,o,a||[]),this.getLocalProperty=this.getLocalProperty,this.setLocalProperty=this.setLocalProperty,this._responsePromise=s?r.then((e=>{if(null==this._redirectedThis._shouldCancel||0==this._redirectedThis._shouldCancel){const t=s(e);return this._callId=t._callId,this.overwriteTargetObject(this._redirectedThis),t.workPromise}return l.reject(new Error("Promise canceled"))})):r}createPublicObject(e){e=e||function CallableTarget(){};const t=super.createPublicObject(e);return null!=this._responsePromise._callId&&(e._callId=this._responsePromise._callId),e._responsePromise.then((function(r){const s=e._options.objectSerializer.getObjectIdBySerializedObjectMessage(r);r.callId&&e._options.objectSerializer._paramTracker.bindParamsToObjectLifetime(t,r.callId),null!==s&&(e._options.remoteRefTracker.addReference(s),e._options.localRefTracker.watchForRelease(e,e._options.remoteRefTracker.removeReference.bind(e._options.remoteRefTracker,s)))})).catch((e=>{window.debugChromeWebViewRemoteObjects&&h.log("caught without rethrowing '"+e.parameters.error+"'")})),e._responsePromise=e._responsePromise.then((function(r){const s=e._options.objectSerializer,o=s.getObjectIdBySerializedObjectMessage(r);if(null!==o){let a=s.getHostKeyNamesBySerializedObjectMessage(r);"function"!=typeof a&&0==a.length&&(a=e._hostKeyNames);new KnownAsyncRemoteProxy(e._options,e._thenable,r,e._debugId,a).overwriteTargetObject(e),0!=o&&s.setObjectProxyOptionsFromResponse(t,r)}return r})),t}sync(){return this._responsePromise.then((e=>this._options.objectSerializer.deserialize(!0,e.parameters.has_object,this._debugId.concat("sync"),e.parameters.result)),(e=>{let t=e;throw e instanceof Error||(t=new Error(this._options.objectSerializer.deserialize(!0,e.parameters.has_object,this._debugId.concat("sync"),e.parameters.error))),t}))}applyHostFunction(e){return new AsyncRemoteProxy(this._options,!0,this._responsePromise,(t=>{const r=this._options.objectSerializer.getObjectIdBySerializedObjectMessage(t);if(null!==r){let t=this._options.remoteMessenger.postRequestMessage(r,"","apply",e);return{workPromise:t,_callId:t._callId}}throw new Error("Unable to call method on non-function.")}),this._debugId.concat("()")).createPublicObject()}getHostProperty(e){return new AsyncRemoteProxy(this._options,!0,this._responsePromise.then((t=>{const r=this._options.objectSerializer.getObjectIdBySerializedObjectMessage(t);return null!==r?this._options.remoteMessenger.postRequestMessage(r,e,"get",[]).then((t=>(this._tryCacheResult(!1,e,t),t))):l.resolve({remoteObjectId:-1,parameters:{result:t.parameters.result[e]}})})),null,this._debugId.concat(e)).createPublicObject()}getForceRemoteProperty(e){return this.getHostProperty(e).then((e=>e),(t=>{if(this._isLocalProperty(e))return this.getLocalProperty(e);throw t}))}setForceRemoteProperty(e,t){return this.setHostProperty(e,t).then((e=>e),(r=>{if(this._isLocalProperty(e))return this.setLocalProperty(e,t);throw r}))}setHostProperty(e,t){return this._responsePromise.then((r=>{const s=this._options.objectSerializer.getObjectIdBySerializedObjectMessage(r);return null!==s?new AsyncRemoteProxy(this._options,!0,this._options.remoteMessenger.postRequestMessage(s,e,"set",[t]),null,this._debugId.concat("setHostProperty")).createPublicObject():r.parameters.result[e]=t})).then((()=>l.resolve(t)))}_then(e,t){return this._responsePromise.then((r=>{r.parameters&&r.parameters.result&&r.parameters.result.hasOwnProperty(this._options.objectSerializer._serializationOptionsPropertyName)&&(r.parameters.result.callId=r.callId);let s=e(this._options.objectSerializer.deserialize(!1,r.parameters.has_object,this._debugId.concat("then"),r.parameters.result));return this._options.objectSerializer._paramTracker.removeParams(r.callId),e=t=function(){},r=null,s}),(r=>{let s=null;return r instanceof Error?s=t(r):(s=t(new Error(this._options.objectSerializer.deserialize(!1,r.parameters.has_object,this._debugId.concat("then"),r.parameters.error))),this._options.objectSerializer._paramTracker.removeParams(r.callId)),e=t=function(){},r=null,s}))}_catch(e){this._then(void 0,e)}}class KnownAsyncRemoteProxy extends RemoteProxy{constructor(e,t,r,s,o){super(e,t,s,o),this.getLocalProperty=this.getLocalProperty,this.setLocalProperty=this.setLocalProperty,this._response=r;const a=this._options.objectSerializer;a.updateSequenceNumberFromSerializedObjectMessage(this._response),this._remoteObjectId=a.getObjectIdBySerializedObjectMessage(this._response),h.assert(null!==this._remoteObjectId)}sync(){return l.resolve(new SyncRemoteProxy(this._options,this._response,this._debugId,this._hostKeyNames).createPublicObject())}applyHostFunction(e){return new AsyncRemoteProxy(this._options,!0,this._options.remoteMessenger.postRequestMessage(this._remoteObjectId,"","apply",e),null,this._debugId.concat("()")).createPublicObject()}getHostProperty(e){return new AsyncRemoteProxy(this._options,!0,this._options.remoteMessenger.postRequestMessage(this._remoteObjectId,e,"get",[]).then((t=>(this._tryCacheResult(!1,e,t),t))),null,this._debugId.concat(e)).createPublicObject()}getForceRemoteProperty(e){return this.getHostProperty(e).then((e=>e),(t=>{if(this._isLocalProperty(e))return this.getLocalProperty(e);throw t}))}setForceRemoteProperty(e,t){return this.setHostProperty(e,t).then((e=>e),(r=>{if(this._isLocalProperty(e))return this.setLocalProperty(e,t);throw r}))}setHostProperty(e,t){return new AsyncRemoteProxy(this._options,!0,this._options.remoteMessenger.postRequestMessage(this._remoteObjectId,e,"set",[t]),null,this._debugId.concat("setHostProperty")).createPublicObject()}_then(e,t){if(this._response.parameters.error){let e=l.reject(t(new Error(this._options.objectSerializer.deserialize(!1,this._response.parameters.has_object,this._debugId.concat("then"),this._response.parameters.error))));return this._options.objectSerializer._paramTracker.removeParams(this._response.callId),e}{this._response.parameters&&this._response.parameters.result&&this._response.parameters.result.hasOwnProperty(this._options.objectSerializer._serializationOptionsPropertyName)&&(this._response.parameters.result.callId=this._response.callId);let t=l.resolve(e(this._options.objectSerializer.deserialize(!1,this._response.parameters.has_object,this._debugId.concat("then"),this._response.parameters.result)));return this._options.objectSerializer._paramTracker.removeParams(this._response.callId),t}}_catch(e){this._then(void 0,e)}createPublicObject(e){e=e||function CallableTarget(){};const t=super.createPublicObject(e);return e._options.remoteRefTracker.addReference(e._remoteObjectId),e._options.localRefTracker.watchForRelease(e,e._options.remoteRefTracker.removeReference.bind(e._options.remoteRefTracker,e._remoteObjectId)),t}}class SyncRemoteProxy extends RemoteProxy{constructor(e,t,r,s){super(e,!1,r,s),this._response=t,this.getLocalProperty=this.getLocalProperty,this.setLocalProperty=this.setLocalProperty,this._resultObjectId=this._options.objectSerializer.getObjectIdBySerializedObjectMessage(this._response),null!==this._resultObjectId&&(this._options.remoteRefTracker.addReference(this._resultObjectId),this._options.localRefTracker.watchForRelease(this,this._options.remoteRefTracker.removeReference.bind(this._options.remoteRefTracker,this._resultObjectId)))}async(){return new AsyncRemoteProxy(this._options,!0,l.resolve(this._response),null,this._debugId,this._hostKeyNames).createPublicObject()}applyHostFunction(e){if(null!==this._resultObjectId){const t=this._debugId?.slice(-1)[0];if(t&&chrome.webview.hostObjects.getLocalProperty("options")?.forceAsyncMethodMatches?.filter((e=>t.match(e)))?.length>0){let t=this.async().applyHostFunction(e),r=t.sync();return r._cancelablePromise=t,r}return this._options.remoteMessenger.postSyncRequestMessage(this._resultObjectId,"","apply",e,this._debugId.concat("()")).value}throw new Error("Unable to call method on non-function.")}getHostProperty(e){if(null!==this._resultObjectId){let t=this._options.remoteMessenger.postSyncRequestMessage(this._resultObjectId,e,"get",[],this._debugId.concat(e));return t.cache_able&&this.setLocalProperty(e,t.value),t.value}return this._response.parameters.result[e]}getForceRemoteProperty(e){try{return this.getHostProperty(e)}catch(t){if(this._isLocalProperty(e))return this.getLocalProperty(e);throw t}}setForceRemoteProperty(e,t){try{return this.setHostProperty(e,t)}catch(r){if(this._isLocalProperty(e))return this.setLocalProperty(e,t);throw r}}setHostProperty(e,t){if(null!==this._resultObjectId)return this._options.remoteMessenger.postSyncRequestMessage(this._resultObjectId,e,"set",[t],this._debugId.concat(e)).value;return this._response.parameters.result[e]=t}createPublicObject(e){e=e||function CallableTarget(){};const t=super.createPublicObject(e);return null!==e._resultObjectId&&(e._options.remoteRefTracker.addReference(e._resultObjectId),e._options.localRefTracker.watchForRelease(e,e._options.remoteRefTracker.removeReference.bind(e._options.remoteRefTracker,e._resultObjectId))),t}}class RemoteProxyGroup{constructor(e,t,s,o,a){window.debugChromeWebViewRemoteObjects&&!a&&(a=h.log.bind(h)),this._groupId=o||"28C1DF41-5C2A-4AA9-84B6-D5172F346B26",this._options={log:a,shouldSerializeDates:!1,forceLocalProperties:["then","toJSON"],shouldPassTypedArraysAsArrays:!1},this._proxyOptions={localRefTracker:null,remoteRefTracker:null,idGenerator:null,forceLocalProperties:this._options.forceLocalProperties,objectSerializer:null,remoteMessenger:null},this._proxyOptions.localRefTracker=new LocalRefTracker(this._log.bind(this)),this._proxyOptions.remoteRefTracker=new RemoteRefTracker(s,this._log.bind(this)),this._proxyOptions.idGenerator=new IdGenerator,this._proxyOptions.objectSerializer=new ObjectSerializer(this._proxyOptions.idGenerator,this._groupId,this._proxyOptions,this._options),this._proxyOptions.remoteMessenger=new RemoteMessenger(e,t,this._log.bind(this),this._proxyOptions.idGenerator,this._proxyOptions.objectSerializer),this.hostObjects=this._proxyOptions.objectSerializer.createKnownRemoteProxy(0,!1,!1,["asyncRoot"],void 0,[]),delayPropertyCreation(this.hostObjects,"sync",(()=>this._proxyOptions.objectSerializer.createKnownRemoteProxy(0,!1,!0,["syncRoot"],void 0,[]))),this.hostObjects.setLocalProperty("options",this._options),this.hostObjects.setLocalProperty("cleanupSome",this._proxyOptions.localRefTracker.cleanupSome.bind(this._proxyOptions.localRefTracker)),r&&(this.remoteObjects=this.hostObjects),this.localObjects={},this.hostObjects.setLocalProperty("cancelPromise",this.cancelPromise.bind(this)),this._proxyOptions.objectSerializer.setObjectByWellKnownObjectId(this.localObjects,0)}_setNativeRemoteObjectEventTarget(e){this._proxyOptions.remoteMessenger._setNativeRemoteObjectEventTarget(e)}_log(e,t){this._options.log&&this._options.log(e,t)}cancelPromise(e){e.hasOwnProperty("_cancel")?e._cancel():e.hasOwnProperty("_cancelablePromise")&&e._cancelablePromise._cancel()}}const s=new e,y={};[{object:s,names:["postMessage","releaseBuffer"]},{object:new d,names:["addEventListener","removeEventListener","dispatchEvent"]}].forEach((e=>e.names.forEach((t=>y[t]=e.object[t].bind(e.object))))),i&&(y.getTextureStream=s.getTextureStream.bind(s),y.registerTextureStream=s.registerTextureStream.bind(s),y.unregisterTextureStream=s.unregisterTextureStream.bind(s)),n&&(y.postMessageWithAdditionalObjects=s.postMessageWithAdditionalObjects.bind(s));const b=new RemoteProxyGroup(s.postRemoteObjectCall.bind(s),o?null:y,s.releaseObjectsCallback.bind(s));return y.hostObjects=b.hostObjects,r&&(y.remoteObjects=y.hostObjects),y.RemoteProxyGroup=RemoteProxyGroup,o&&(b._setNativeRemoteObjectEventTarget(s),s.addEventListener("message",(e=>{a&&h.log("native event:",e);let t=new Event("message");c.defineProperty(t,"data",{value:p.parse(e.data)}),c.defineProperty(t,"source",{value:y}),c.defineProperty(t,"additionalObjects",{value:e.additionalObjects}),y.dispatchEvent(t)})),s.addEventListener("sharedbufferreceived",(e=>{a&&h.log("native event:",e);let t=!1,r=new Event("sharedbufferreceived");e.data&&c.defineProperty(r,"additionalData",{value:p.parse(e.data)}),c.defineProperty(r,"getBuffer",{value:function(){return t=!0,e.sharedBuffer}}),c.defineProperty(r,"sharedBuffer",{value:e.sharedBuffer}),c.defineProperty(r,"source",{value:y}),y.dispatchEvent(r),t||chrome.webview.releaseBuffer(e.sharedBuffer)}))),y}))}}})();; delete globalParams;" (Indicator: "postmessage"; Source: "00000000-00002160.00000000.305187.01000000.00000004.mdmp") Found reference to API "window.external={invoke:s=>window.chrome.webview.postMessage(s)}U" (Indicator: "postmessage"; Source: "00000000-00002160.00000000.305187.01000000.00000004.mdmp") Found reference to API "usePostMessageWithAdditionalObjects" (Indicator: "postmessage"; Source: "00000000-00002160.00000000.305187.01000000.00000004.mdmp") Found reference to API "postMessageWithAdditionalObjectsU" (Indicator: "postmessage"; Source: "00000000-00002160.00000000.305187.01000000.00000004.mdmp") Found reference to API "postMessage" (Indicator: "postmessage"; Source: "00000000-00002160.00000001.307105.00200000.00000002.mdmp") Found reference to API "AttemptToNotifyRunningChrome:SendMessage" (Indicator: "sendmessage"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp")36:T1170,"msedgewebview2.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000000000003e0000000000000000801100b06b0000020000000000000038e53f79ef000000000000000000000000000000000000003042a1edb9020000c0e43f79ef0000000000000000000000ffb5aee9ff7f0000000000000000000000000e00b06b0000800000000000000096f5aae9ff7f0000b8e53f79ef00000000c01000b06b00003e0000000000000040000000000000800010f399276d000080f3d7e9ff7f00000017f399276d000090ecaae9ff7f000030000000000000000000000000000000c0e43f79ef00000040000000000000000000000000000000f3854918f87f0000c00000000000000080f3d7e9ff7f000000000e00 (UID: 00000000-00006572) "msedgewebview2.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006572) "msedgewebview2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006572) "msedgewebview2.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c9388e15f87f000080000000000000000000000000000000a0baa5edb902000010334c18f87f000000000000000000000000ed16f87f000050ce3f79ef00000010418b15f87f0000000000000000000010ce3f79ef000000000000000000000000000000000000000100000000000000b8408b15f87f0000000000000000000001000000000000000000ed16f87f00003b4dd215f87f00000000000000000000c8d23f79ef0000000000000000000000d02aff16f87f000010b36517f87f0000e8f88a15f87f000010b36517f87f0000d02aff16f87f00000d000000f87f00000d00000000000000a0f65517f87f0000f587fa16f87f0000d02aff16 (UID: 00000000-00006572) "msedgewebview2.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c9388e15f87f000000000000000000000000000000000000000000000000000010334c18f87f000000000000000000000000cb03f87f0000a0ad3f79ef00000010418b15f87f0000000000000000000010334c18f87f000000000000000000000000cb03f87f0000d0ad3f79ef00000010418b15f87f0000000000000000000090ad3f79ef000000000000000000000000000000000000000100000000000000b8408b15f87f0000000000000000000001000000000000000000cb03f87f00003b4dd215f87f0000000000000000000048b23f79ef000000000000000000000020f9d003f87f0000b0a5e003f87f0000e8f88a15f87f0000b0a5e003 (UID: 00000000-00006572) "msedgewebview2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000a0bb3f79ef000000b0bb3f79ef000000010000003412000000000000ef0000000400000000000000017882efb9020000e027f112f87f0000a586d415f87f00000000000000000000820000000000000000000000000000007efed115f87f00000000000000000000a0bb3f79ef000000b0bb3f79ef00000001000000f87f000000000000000000000400000000000000000000000000000000008884b90200000010000000000000e027f112f87f000001000000000000007e85d415f87f000001000000ef00000030000000ef0000006000000000000000b0bb3f79ef00000008000000 (UID: 00000000-00006572) "msedgewebview2.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000000000000100000000000000b8408b15f87f000000000000000000000100000000000000000045fbff7f00003b4dd215f87f0000000000000000000068983f79ef0000000000000000000000a03f46fbff7f000030b84afbff7f0000e8f88a15f87f000030b84afbff7f0000a03f46fbff7f00000d000000000000000d000000f87f000098d049fbff7f0000610846fbff7f0000a03f46fbff7f0000d64e4a18f87f000000000000fcffffff8b5b5ccfff7f000090d049fbff7f0000810846fbff7f00000000000000000000000000000000000000000000eb271c0000000000000400bc0100000000000000e90746fbff7f000007000000 (UID: 00000000-00006572)37:Te0f,"msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\throttle_store.dat" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\settings.dat" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Variations" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-eccaa385-d549-424a-8f96-148c3e2a2bbf.tmp" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\index" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\data_0" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\data_1" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\data_2" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\data_3" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Last Version" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\README" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-76b2d190-3d46-44f3-8d93-867ffcceb31c.tmp" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache\js\index" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache\wasm\index" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache\wasm\index-dir\temp-index" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-e1f00d4e-7ae9-4f3d-a4cd-140e666908e0.tmp" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Site Characteristics Database\000001.dbtmp" "msedgewebview2.exe" writes to a file "%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension Rules\MANIFEST-000001"38:Te26,"msedgewebview2.exe" queries volume information of "C:\Windows\System32\drivers\etc\hosts" at 00000000-00006572-00000C17-3425399912 "msedgewebview2.exe" queries volume information of "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\MEIPreload\manifest.json" at 00000000-00006572-00000C17-3430678789 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00000000-00006572-00000C17-3431533251 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\seguisb.ttf" at 00000000-00006572-00000C17-3431686252 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\timesi.ttf" at 00000000-00006572-00000C17-3433897573 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\ARIALNB.TTF" at 00000000-00006572-00000C17-3434107675 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\ARIALNB.TTF" at 00000000-00006572-00000C17-3434193275 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\arialbi.ttf" at 00000000-00006572-00000C17-3434194981 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\arialbi.ttf" at 00000000-00006572-00000C17-3434200157 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\ARIALNBI.TTF" at 00000000-00006572-00000C17-3434204142 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\ARIALNBI.TTF" at 00000000-00006572-00000C17-3434208269 "msedgewebview2.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00006572-00000C17-3438917357 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\segoeuil.ttf" at 00000000-00006572-00000C17-3439655316 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\seguili.ttf" at 00000000-00006572-00000C17-3439669701 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\segoeuisl.ttf" at 00000000-00006572-00000C17-3439675663 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\seguisli.ttf" at 00000000-00006572-00000C17-3439683731 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\seguisbi.ttf" at 00000000-00006572-00000C17-3439690801 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\segoeuiz.ttf" at 00000000-00006572-00000C17-3439695025 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\seguibl.ttf" at 00000000-00006572-00000C17-3439701003 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\seguibli.ttf" at 00000000-00006572-00000C17-3439705669 "msedgewebview2.exe" queries volume information of "C:\Windows\Fonts\georgia.ttf" at 00000000-00006572-00000C17-3439786808 "msedgewebview2.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\reports\0b50d14e-6713-41f2-9197-30ff6ff07a80.dmp" at 00000000-00007364-00000C17-3502862605 "msedgewebview2.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\reports\0b50d14e-6713-41f2-9197-30ff6ff07a80.dmp" at 00000000-00007364-00000C17-3502873147 "msedgewebview2.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\reports\0b50d14e-6713-41f2-9197-30ff6ff07a80.dmp" at 00000000-00007364-00000C17-3502877392 "msedgewebview2.exe" queries volume information of "C:\Windows\System32\drivers\etc\hosts" at 00000000-00006372-00000C17-343022153939:T529,"msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0119E81BE9A14CD8E22F40AC118C687ECBA3F4D8"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\06F1AA330B927B753A40E68CDF22E34BCBEF3352"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\2B45CA4F1FAC7F93EC09EABC096123B1E95C0108"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\31F9FC8BA3805986B721EA7295C65B3A44534274"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB")3a:Tfb7,"msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\reports (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\attachmen (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\BrowserMetrics (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\component_crx_cach (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Cache (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Cache\Cach (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Cache\No_V (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Shared Dic (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\ClientCert (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Site Chara (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Sync Data (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Sync Data\ (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\discount_i (UID: 00000000-00006572) "msedgewebview2.exe" called "CreateDirectoryW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\discounts_ (UID: 00000000-00006572)3b:Tbdc,"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.7816.6780.1729321346947612973" - (UID: 00000000-00007816) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\crashpad_6572_OLYRXJHCMVDTQARA" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.7708.4810844203598286688" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.7708.4276572512845905110" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.7708.4994826369324680207" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.7708.1363261215309360668" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.7708.7266940371857713136" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.1248.5857634567649105635" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.7708.7332143404941688200" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.1248.17740997744935710551" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.1248.16375293212478843929" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.7708.3655925749260754756" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.7708.9567585410654261130" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.7708.14104115865010445203" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.7708.13303763013417386879" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.7708.9040517434856774139" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.7708.1439525111887083810" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.7708.8787016575173890883" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.6572.7708.9217770952825902347" - (UID: 00000000-00006572) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\crashpad_6572_OLYRXJHCMVDTQARA" - (UID: 00000000-00007364) "msedgewebview2.exe" called "NtCreateNamedPipeFile" with parameter "pipe\LOCAL\mojo.2160.2652.13889861785494203091" - (UID: 00000000-00002160)3c:T2b19,"msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntmarta.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedge.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter MDMRegistration.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter DWrite.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter dnsapi.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-shcore-scaling-l1-1-1.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\telclient.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\oneds.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter Iphlpapi.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\oneauth.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter webauthn.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wldp.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l1-1-0.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shcore.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter atlthunk.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter OLEACC.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00006572) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\microsoft_shell_integration.dll (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\dbghelp.dll (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007364) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedge.dll (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter bcryptprimitives (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006372) "msedgewebview2.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00006372)3d:T104f,"msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\BrowserMetrics-spa & %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\BrowserMetrics\Bro (UID: 00000000-00006572) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-T & %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Local State (UID: 00000000-00006572) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache & %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache (UID: 00000000-00006572) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Sync Data\ & %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Sync Data\ (UID: 00000000-00006572) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Site Chara & %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Site Chara (UID: 00000000-00006572) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension & %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension (UID: 00000000-00006572) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_pro & %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_pro (UID: 00000000-00006572) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\component_crx_cach & %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\component_crx_cach (UID: 00000000-00006572) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\88530ea3-1 & %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Secure Pre (UID: 00000000-00006572) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\2c9bf446-8 & %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Preference (UID: 00000000-00006572) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Shared Dic & %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Shared Dic (UID: 00000000-00006372) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\7c & %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\SC (UID: 00000000-00006372) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\e7 & %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\Sd (UID: 00000000-00006372) "msedgewebview2.exe" called "MoveFileW" with parameter %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\48 & %APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\Ne (UID: 00000000-00006372)3e:Td134,"msedgewebview2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlGetDeviceFamilyInfoEnum (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter BuildExplicitAccessWithNameW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter BuildSecurityDescriptorW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter AccProvGetCapabilities (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsSandboxedProcess (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtSetInformationProcess (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsValidSecurityDescriptor (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorControl (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorGroup (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorSacl (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsValidAcl (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateProcessAsUserW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter PrefetchVirtualMemory (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter ChromeMain (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateWindowStationW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetThreadDesktop (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter BuildTrusteeWithSidW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetProcessWindowStation (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateDesktopW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterClassExW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter EdgeGetAlternatePrefetchResult (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsDeviceRegisteredWithManagement (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter NetGetAadJoinInformation (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter NetFreeAadJoinInformation (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetCurrentPackageFullName (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterPowerSettingNotification (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterSuspendResumeNotification (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetProcessDpiAwarenessContext (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjectsEx (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CryptProtectData (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSALookupServiceBeginW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSALookupServiceNextW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSALookupServiceEnd (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSACreateEvent (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter NotifyAddrChange (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetPropW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterPointerDeviceNotifications (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter DnsIsZtEnabled (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetPointerDevices (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDisplayConfigBufferSizes (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter QueryDisplayConfig (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter DisplayConfigGetDeviceInfo (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RoActivateInstance (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterDeviceNotificationW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetICMProfileW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetTokenInformation (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter MapGenericMask (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter AccessCheck (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateRestrictedToken (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetQueueStatus (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateSplitter (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter FreeSplitter (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter FreeLogs (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateTelemetryClientDecoder (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter FreeTelemetryClientDecoder (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter FreeTelemetryClientDecoderPayload (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateOneDSWrapper (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter FreeOneDSWrapper (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateCommonSchemaHelper (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter FreeCommonSchemaHelper (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateEventListenerService (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter FreeEventListenerService (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDecodeDebugEventBufferFunc (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlConvertDeviceFamilyInfoToString (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetAdaptersInfo (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CryptProtectMemory (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter LdrRegisterDllNotification (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetPersistedRegistryValueW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetCaretBlinkTime (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetNamedSecurityInfoW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetNamedSecurityInfoW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter AddMandatoryAce (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNIsUserVerifyingPlatformAuthenticatorAvailable (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNAuthenticatorMakeCredential (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNAuthenticatorGetAssertion (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNCancelCurrentOperation (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNGetErrorName (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNFreeCredentialAttestation (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNFreeAssertion (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNGetPlatformCredentialList (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNFreePlatformCredentialList (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNDeletePlatformCredential (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WebAuthNGetApiVersionNumber (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WldpQueryWindowsLockdownMode (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetPackagesByPackageFamily (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetCurrentApplicationUserModelId (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter ImmGetIMEFileNameW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter PerfStartProviderEx (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter PerfSetCounterSetInfo (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CryptUnprotectMemory (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CertAddStoreToCollection (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlIsStateSeparationEnabled (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter OneAuthInitialize (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetProcessDpiAwareness (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter LoadIconW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter LoadImageW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter EnableNonClientDpiScaling (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsIconic (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsZoomed (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSystemMetricsForDpi (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter PathMatchSpecW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CertControlStore (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterDragDrop (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfaces (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter PerfCreateInstance (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter PerfSetCounterRefValue (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateBitmap (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateIconIndirect (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetPropW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutNameW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowDisplayAffinity (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetClassInfoExW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtOpenSection (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlInitUnicodeString (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter AtlThunk_AllocateData (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter AtlThunk_InitData (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter AtlThunk_DataToCode (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter AtlThunk_FreeData (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateStdAccessibleObject (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetInputScope (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter ChildWindowFromPoint (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetProcessLaunchForegroundPolicy (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter UuidCreate (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderPathW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CertFindCertificateInStore (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CertGetEnhancedKeyUsage (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter PerfDeleteInstance (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter OneAuthReadAllAccounts (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter OneAuthDiscoverAccounts (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter EnableWindow (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetParent (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsWindowArranged (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CharLowerW (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowDC (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateRectRgnIndirect (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CombineRgn (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsRectEmpty (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter TrackMouseEvent (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetMessageTime (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetCapture (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter WindowFromPoint (UID: 00000000-00006572) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlGetDeviceFamilyInfoEnum (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetNamedPipeClientProcessId (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtSuspendProcess (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlGetUnloadEventTraceEx (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter NetGetAadJoinInformation (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter NetFreeAadJoinInformation (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetProcessAppSessionGuid (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetWindowsFlightIdsComponentStr (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter WindowsGetStringRawBuffer (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpAddRequestHeaders (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter MiniDumpWriteDump (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtResumeProcess (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007364) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter RtlGetDeviceFamilyInfoEnum (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter PrefetchVirtualMemory (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter ChromeMain (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjectsEx (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSALookupServiceBeginW (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSALookupServiceNextW (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSALookupServiceEnd (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSACreateEvent (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter NotifyAddrChange (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter DhcpCApiInitialize (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSACloseEvent (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSASendTo (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSAResetEvent (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSARecvFrom (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter CryptProtectMemory (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSAEnumNetworkEvents (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00006372) "msedgewebview2.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00006372)3f:T906,"INSERT OR REPLACE INTO meta(key,value) VALUES(?,?)" (Source: 00000000-00006372.00000000.304884.00004000.00000004.mdmp, 00000000-00006372.00000000.304884.00144000.00000004.mdmp, 00000000-00006372.00000000.304884.0024C000.00000004.mdmp, 00000000-00006372.00000001.306805.00004000.00000004.mdmp, 00000000-00006372.00000001.306805.00148000.00000004.mdmp, 00000000-00006372.00000001.306805.001D4000.00000004.mdmp, 00000000-00006372.00000001.306805.0024C000.00000004.mdmp, 00000000-00006372.00000002.308724.00004000.00000004.mdmp, 00000000-00006372.00000002.308724.00148000.00000004.mdmp, 00000000-00006372.00000002.308724.001D4000.00000004.mdmp, 00000000-00006372.00000002.308724.0024C000.00000004.mdmp, 00000000-00006372.00000003.309421.00004000.00000004.mdmp, 00000000-00006372.00000003.309421.00148000.00000004.mdmp, 00000000-00006372.00000003.309421.001D4000.00000004.mdmp, 00000000-00006372.00000003.309421.0024C000.00000004.mdmp, Indicator: "insert or replace into meta(key,value) values(?,?)"), "SELECT value FROM meta WHERE key=?" (Source: 00000000-00006372.00000000.304884.00004000.00000004.mdmp, 00000000-00006372.00000001.306805.00004000.00000004.mdmp, 00000000-00006372.00000001.306805.00374000.00000004.mdmp, 00000000-00006372.00000002.308724.00004000.00000004.mdmp, 00000000-00006372.00000002.308724.00374000.00000004.mdmp, 00000000-00006372.00000003.309421.00004000.00000004.mdmp, 00000000-00006372.00000003.309421.00374000.00000004.mdmp, Indicator: "select value from meta where key=?"), "CREATE TABLE trust_tokens_issuer_toplevel_pair_config ( key TEXT, proto BLOB, PRIMARY KEY(key))" (Source: 00000000-00006372.00000000.304884.00004000.00000004.mdmp, 00000000-00006372.00000000.304884.001C4000.00000004.mdmp, 00000000-00006372.00000003.309421.001C4000.00000004.mdmp, Indicator: "create table trust_tokens_issuer_toplevel_pair_config ( key text, proto blob, primary key(key))"), "DELETE FROM dictionaries WHERE exp_time<=? RETURNING size token_high token_low" (Source: 00000000-00006372.00000000.304884.00024000.00000004.mdmp, 00000000-00006372.00000001.306805.00024000.00000004.mdmp, 00000000-00006372.00000002.308724.00024000.00000004.mdmp, 00000000-00006372.00000003.309421.00024000.00000004.mdmp, Indicator: "delete from dictionaries where exp_time<=? returning size token_high token_low")40:T543,Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "CreateFileFromAppW" (Indicator: "CreateFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "CreateFileVersionInfoWin" (Indicator: "CreateFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp")41:T134fe,Found reference to API (Indicator: "ResumeThread"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "TlsAlloc"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "RaiseFailFastException"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "CreateThread"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "GetStdHandle"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "WerSetFlags"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "ExitProcess"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "SuspendThread"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "CreateEventA"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "VirtualFree"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "WriteFile"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "SetErrorMode"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "WerGetFlags"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "VirtualQuery"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "SetThreadContext"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "GetThreadContext"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "CloseHandle"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "GetErrorMode"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "AddVectoredContinueHandler"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "GetProcAddress"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "SetEvent"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "SwitchToThread"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "HeapQueryInformation"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "InitOnceBeginInitialize"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "InitOnceComplete"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetThreadDescription"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributes"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessAppSessionGuid"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetProductInfo"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphore"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateEvent"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetProcessDpiAwarenessContext"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NetGetAadJoinInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NetFreeAadJoinInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetProcessDpiAwarenessInternal"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetHandleVerifier"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ReplaceFileW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetFileInfo"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "PathMatchSpecW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "Event Name"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "VirtualQueryEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtQueryObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "DeleteFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectory"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "UnlockFileEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValue"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WinHttpOpen"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WinHttpCrackUrl"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WinHttpConnect"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WinHttpSendRequest"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WinHttpWriteData"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WinHttpReadData"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetNamedPipeHandleState"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "TransactNamedPipe"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptor"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "BuildSecurityDescriptor"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipe"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateNamedPipeClient"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ConnectNamedPipe"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "PostMessage"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RegisterClass"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetMessage"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongPtr"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongPtr"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClass"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileName"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtSuspendProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtResumeProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetProcessShutdownParameters"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "LocateXStateFeature"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "Wow64GetThreadContext"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtOpenThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetEnabledXStateFeatures"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtAllocateVirtualMemory"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtCreateFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtCreateSection"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtDuplicateObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtFreeVirtualMemory"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtMapViewOfSection"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtProtectVirtualMemory"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtQueryAttributesFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtQueryVirtualMemory"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtWaitForSingleObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RtlAllocateHeap"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RtlAnsiStringToUnicodeString"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RtlCompareUnicodeString"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RtlCreateHeap"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RtlDestroyHeap"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RtlFreeHeap"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtCreateKey"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtOpenKey"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtOpenSection"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExA"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtOpenKeyEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipeW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "BaseThreadInitThunk"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtOpenThreadToken"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "NtOpenFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateEnvironmentBlock"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "DestroyEnvironmentBlock"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "AccessCheck"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "AddMandatoryAce"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "BuildSecurityDescriptorW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessAsUserW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessWithTokenW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateRestrictedToken"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetAce"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "IsValidAcl"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "MapGenericMask"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetThreadToken"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetTokenInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CloseWindowStation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateDesktopW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowStationW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetThreadDesktop"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetProcessWindowStation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "AssignProcessToJobObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateJobObjectW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateRemoteThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "DeleteProcThreadAttributeList"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "DisconnectNamedPipe"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHandleCount"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeaps"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessMitigationPolicy"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetThreadId"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetThreadPriority"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetThreadPriorityBoost"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetUserGeoID"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "K32GetPerformanceInfo"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "K32GetProcessMemoryInfo"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "OpenThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "QueryInformationJobObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "QueryThreadCycleTime"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureStackBackTrace"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetHandleInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetInformationJobObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetThreadAffinityMask"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetThreadInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPriorityBoost"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "TerminateJobObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWait"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "VirtualFreeEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtectEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WaitNamedPipeW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp")42:T9e1,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp")43:T970,"\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeWebView\msEdgeDisableThirdPartyHook" in Source: 00000000-00002160.00000000.305187.00090000.00000004.mdmp 00000000-00002160.00000001.307105.00090000.00000004.mdmp 00000000-00002160.00000002.309025.00090000.00000004.mdmp 00000000-00002160.00000003.309414.00090000.00000004.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "Software\" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp44:Tbb7,Process 7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7816:120:WilError_03" Process 7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe created mutex with name "Local\SM0:7816:304:WilStaging_02" Process 7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe created mutex with name "Local\SM0:7816:120:WilError_03" Process 7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe created mutex with name "SM0:7816:120:WilError_03" Process 7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe created mutex with name "SM0:7816:304:WilStaging_02" Process 7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe created mutex with name "DBWinMutex" Process 7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe created mutex with name "wails-app-7a8cf666-2335-4eb8-a653-13bd1df9a48dsim" Process 7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7816:304:WilStaging_02" Process 7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe created mutex with name "\Sessions\1\BaseNamedObjects\wails-app-7a8cf666-2335-4eb8-a653-13bd1df9a48dsim" Process 7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7816:304:WilStaging_02" Process 7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBWinMutex" Process 7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7816:120:WilError_03" Process msedgewebview2.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6572:304:WilStaging_02" Process msedgewebview2.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6572:120:WilError_03" Process msedgewebview2.exe created mutex with name "Local\SM0:6572:304:WilStaging_02" Process msedgewebview2.exe created mutex with name "Local\SM0:6572:120:WilError_03" Process msedgewebview2.exe created mutex with name "ChromeProcessSingletonStartup!" Process msedgewebview2.exe created mutex with name "Local\SessionImmersiveColorMutex" Process msedgewebview2.exe created mutex with name "SM0:6572:304:WilStaging_02" Process msedgewebview2.exe created mutex with name "SM0:6572:120:WilError_03" Process msedgewebview2.exe created mutex with name "__OMADM_NAMED_MUTEX__" Process msedgewebview2.exe created mutex with name "3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD" Process msedgewebview2.exe created mutex with name "DBWinMutex" Process msedgewebview2.exe created mutex with name "\Sessions\1\BaseNamedObjects\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD" Process msedgewebview2.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6572:304:WilStaging_02"45:T53d,Found string - \\.\pipe\crashpad_6572_OLYRXJHCMVDTQARA Found string - \\.\pipe\LOCAL\mojo.6572.7708.4810844203598286688 Found string - \\.\pipe\LOCAL\mojo.6572.7708.4276572512845905110 Found string - \\.\pipe\LOCAL\mojo.6572.7708.4994826369324680207 Found string - \\.\pipe\LOCAL\mojo.6572.7708.1363261215309360668 Found string - \\.\pipe\LOCAL\mojo.6572.7708.7266940371857713136 Found string - \\.\pipe\LOCAL\mojo.6572.1248.5857634567649105635 Found string - \\.\pipe\LOCAL\mojo.6572.7708.7332143404941688200 Found string - \\.\pipe\LOCAL\mojo.6572.1248.17740997744935710551 Found string - \\.\pipe\LOCAL\mojo.6572.1248.16375293212478843929 Found string - \\.\pipe\LOCAL\mojo.6572.7708.3655925749260754756 Found string - \\.\pipe\LOCAL\mojo.6572.7708.9567585410654261130 Found string - \\.\pipe\LOCAL\mojo.6572.7708.14104115865010445203 Found string - \\.\pipe\LOCAL\mojo.6572.7708.13303763013417386879 Found string - \\.\pipe\LOCAL\mojo.6572.7708.9040517434856774139 Found string - \\.\pipe\LOCAL\mojo.6572.7708.1439525111887083810 Found string - \\.\pipe\LOCAL\mojo.6572.7708.8787016575173890883 Found string - \\.\pipe\LOCAL\mojo.6572.7708.9217770952825902347 Found string - EDGE_CRASHPAD_PIPE_NAME=\\.\pipe\crashpad_6572_OLYRXJHCMVDTQARA Found string - \\.\pipe\ Found string - EDGE_CRASHPAD_PIPE_NAME=\\.\pipe\crash46:T5d96,"\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeWebView\msEdgeDisableThirdPartyHook" in Source: 00000000-00002160.00000000.305187.00090000.00000004.mdmp "\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeWebView\msEdgeDisableThirdPartyHook" in Source: 00000000-00002160.00000001.307105.00090000.00000004.mdmp "\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeWebView\msEdgeDisableThirdPartyHook" in Source: 00000000-00002160.00000002.309025.00090000.00000004.mdmp "\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeWebView\msEdgeDisableThirdPartyHook" in Source: 00000000-00002160.00000003.309414.00090000.00000004.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "Software\" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "Software\" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00006372.00000001.306805.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge\WebView2" in Source: 00000000-00006572.00000000.304384.0018C000.00000004.mdmp "Software\Microsoft\EdgeWebView\StabilityMetrics" in Source: 00000000-00006572.00000000.304384.0018C000.00000004.mdmp "Software\Microsoft\EdgeWebView\PreferenceMACs\Default" in Source: 00000000-00006572.00000001.306304.00004000.00000004.mdmp "-1001\Software\Microsoft\EdgeWebView\" in Source: 00000000-00006572.00000001.306304.000E8000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006572.00000001.306304.00174000.00000004.mdmp "\REGISTRY\MACHINE\System\CurrentControlSet\Control\Srp\" in Source: 00000000-00006572.00000001.306304.00174000.00000004.mdmp "\REGISTRY\MACHINE\System\CurrentControlSet\Control\Srp" in Source: 00000000-00006572.00000001.306304.00174000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Edge\WebView2" in Source: 00000000-00006572.00000001.306304.0018C000.00000004.mdmp "Software\Microsoft\EdgeWebView\StabilityMetrics" in Source: 00000000-00006572.00000001.306304.0018C000.00000004.mdmp "12392235-1001\Software\" in Source: 00000000-00006572.00000001.306304.00770000.00000004.mdmp "SOFTWARE\Tencent\QQBrowser" in Source: 00000000-00006572.00000001.306304.00924000.00000004.mdmp "SOFTWARE\360\360se6" in Source: 00000000-00006572.00000001.306304.00924000.00000004.mdmp "SOFTWARE\Lenovo\SLBrowser" in Source: 00000000-00006572.00000001.306304.00924000.00000004.mdmp "SOFTWARE\360Chrome" in Source: 00000000-00006572.00000001.306304.00924000.00000004.mdmp "SOFTWARE\360ChromeX" in Source: 00000000-00006572.00000001.306304.00924000.00000004.mdmp "SOFTWARE\SogouExplorer" in Source: 00000000-00006572.00000001.306304.00924000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00006572.00000001.306304.80F13000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{DAA52B27-8897-50AF-ADA5-C6C71BB64E17}" in Source: 00000000-00006572.00000001.306304.80F13000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00006572.00000001.306304.80F13000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\TrustedPeople" in Source: 00000000-00006572.00000001.306304.80F13000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00006572.00000001.306304.80F42000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\ROOT" in Source: 00000000-00006572.00000001.306304.80F42000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1271187874-1938232448-3812392235-1001" in Source: 00000000-00006572.00000001.306304.84C00000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006572.00000001.306304.84C00000.00000004.mdmp "938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006572.00000001.306304.84C00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\TokenBroker\ProviderInfo\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy" in Source: 00000000-00006572.00000001.306304.84C00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006572.00000001.306304.E9557000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00006572.00000001.306304.E9557000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00006572.00000001.306304.E9557000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00006572.00000001.306304.E9557000.00000002.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00006572.00000001.306304.EDA73000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{2DBDBA9D-20DA-519D-9078-09F835BC5BC7}" in Source: 00000000-00006572.00000001.306304.EDA73000.00000004.mdmp "Software\Microsoft\EdgeWebView\PreferenceMACs\Default" in Source: 00000000-00006572.00000002.308223.00004000.00000004.mdmp "\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\EdgeWebView\msProcessIntegrityV4" in Source: 00000000-00006572.00000002.308223.00118000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006572.00000002.308223.00174000.00000004.mdmp "\REGISTRY\MACHINE\System\CurrentControlSet\Control\Srp\" in Source: 00000000-00006572.00000002.308223.00174000.00000004.mdmp "\REGISTRY\MACHINE\System\CurrentControlSet\Control\Srp" in Source: 00000000-00006572.00000002.308223.00174000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Edge\WebView2" in Source: 00000000-00006572.00000002.308223.0018C000.00000004.mdmp "Software\Microsoft\EdgeWebView\StabilityMetrics" in Source: 00000000-00006572.00000002.308223.0018C000.00000004.mdmp "12392235-1001\Software\" in Source: 00000000-00006572.00000002.308223.00770000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00006572.00000002.308223.80F13000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{DAA52B27-8897-50AF-ADA5-C6C71BB64E17}" in Source: 00000000-00006572.00000002.308223.80F13000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00006572.00000002.308223.80F13000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\TrustedPeople" in Source: 00000000-00006572.00000002.308223.80F13000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00006572.00000002.308223.80F42000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\ROOT" in Source: 00000000-00006572.00000002.308223.80F42000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1271187874-1938232448-3812392235-1001" in Source: 00000000-00006572.00000002.308223.84C00000.00000004.mdmp "938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006572.00000002.308223.84C00000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006572.00000002.308223.84C00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\TokenBroker\ProviderInfo\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy" in Source: 00000000-00006572.00000002.308223.84C00000.00000004.mdmp "-1001\Software\Microsoft\EdgeWebView\" in Source: 00000000-00006572.00000003.309397.000E8000.00000004.mdmp "SOFTWARE\Tencent\QQBrowser" in Source: 00000000-00006572.00000003.309397.00924000.00000004.mdmp "SOFTWARE\360\360se6" in Source: 00000000-00006572.00000003.309397.00924000.00000004.mdmp "SOFTWARE\Lenovo\SLBrowser" in Source: 00000000-00006572.00000003.309397.00924000.00000004.mdmp "SOFTWARE\360Chrome" in Source: 00000000-00006572.00000003.309397.00924000.00000004.mdmp "SOFTWARE\360ChromeX" in Source: 00000000-00006572.00000003.309397.00924000.00000004.mdmp "SOFTWARE\SogouExplorer" in Source: 00000000-00006572.00000003.309397.00924000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceRegistration" in Source: 00000000-00006572.00000003.309397.E9082000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00006572.00000003.309397.E9082000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00006572.00000003.309397.E9082000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00006572.00000003.309397.E9082000.00000002.mdmp "Software\Policies\Microsoft\Edge\WebView2\" in Source: 00000000-00006572.00000003.309397.E9082000.00000002.mdmp "SOFTWARE\Microsoft\AuthN" in Source: 00000000-00006572.00000003.309397.E9082000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006572.00000003.309397.E98B2000.00000002.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00006572.00000003.309397.EDA73000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{2DBDBA9D-20DA-519D-9078-09F835BC5BC7}" in Source: 00000000-00006572.00000003.309397.EDA73000.00000004.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\SQMClient" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "Hardware\Description\System\CentralProcessor\0" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Flighting\Build" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient\Windows\CommonDatapoints" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "Software\" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00007364.00000002.308346.6C58D000.00000002.mdmp "HINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00007364.00000002.308346.D422D000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\MiniDumpAuxiliaryDlls" in Source: 00000000-00007364.00000003.309441.D422D000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00007364.00000003.309441.E9CA2000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00007364.00000003.309441.E9CA2000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00007364.00000003.309441.E9CA2000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00007364.00000003.309441.E9CA2000.00000002.mdmp "Software\" in Source: 00000000-00007364.00000003.309441.E9CA2000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00007364.00000003.309441.E9CA2000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007364.00000003.309441.E9CA2000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00007364.00000003.309441.E9CA2000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007364.00000003.309441.E9CA2000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115" in Source: 00000000-00007816.00000000.304332.A2E80000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00007816.00000000.304332.A2E80000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007816.00000000.304332.A2F80000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007816.00000000.304332.A2F80000.00000004.mdmp "Software\Classes\CLSID\" in Source: 00000000-00007816.00000000.304332.EA26F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" in Source: 00000000-00007816.00000000.304332.EA26F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00007816.00000000.304332.EA26F000.00000002.mdmp "Software\Policies\Microsoft\Edge\WebView2\" in Source: 00000000-00007816.00000000.304332.EA26F000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007816.00000000.304332.EA26F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007816.00000000.304332.EA26F000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00007816.00000000.304332.EA26F000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00007816.00000000.304332.EA26F000.00000002.mdmp "Software\" in Source: 00000000-00007816.00000000.304332.EA26F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00007816.00000000.304332.EA26F000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00007816.00000000.304332.EA26F000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00007816.00000000.304332.EA26F000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00007816.00000000.304332.EA26F000.00000002.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007816.00000000.304332.F3C10000.00000004.mdmp "Y\MACHINE\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007816.00000000.304332.F3C10000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115" in Source: 00000000-00007816.00000001.306252.A2DB2000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00007816.00000001.306252.A2DB2000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115" in Source: 00000000-00007816.00000001.306252.A2E80000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00007816.00000001.306252.A2E80000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007816.00000001.306252.A2F80000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007816.00000001.306252.A2F80000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007816.00000001.306252.F3C10000.00000004.mdmp "Y\MACHINE\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007816.00000001.306252.F3C10000.00000004.mdmp "y\Machine\Software\Classes\AppID\7169885e9230836cf829ee86035A" in Source: 00000000-00007816.00000001.306252.F3C10000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115" in Source: 00000000-00007816.00000002.308175.A2DB2000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00007816.00000002.308175.A2DB2000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115" in Source: 00000000-00007816.00000002.308175.A2E80000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00007816.00000002.308175.A2E80000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007816.00000002.308175.A2F80000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007816.00000002.308175.A2F80000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007816.00000002.308175.F3C10000.00000004.mdmp "EGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007816.00000002.308175.F3C10000.00000004.mdmp "y\Machine\Software\Classes\AppID\7169885e9230836cf829ee86035A" in Source: 00000000-00007816.00000002.308175.F3C10000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115" in Source: 00000000-00007816.00000003.309870.A2DB2000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00007816.00000003.309870.A2DB2000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115" in Source: 00000000-00007816.00000003.309870.A2E80000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00007816.00000003.309870.A2E80000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007816.00000003.309870.A2F80000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" in Source: 00000000-00007816.00000003.309870.A2F80000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00007816.00000003.309870.A3080000.00000004.mdmp "y\Machine\Software\Classes\AppID\7169885e9230836cf829ee86035A" in Source: 00000000-00007816.00000003.309870.F3C10000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00008056.00000000.305639.E9CA2000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00008056.00000000.305639.E9CA2000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00008056.00000000.305639.E9CA2000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00008056.00000000.305639.E9CA2000.00000002.mdmp "Software\" in Source: 00000000-00008056.00000000.305639.E9CA2000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00008056.00000000.305639.E9CA2000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00008056.00000000.305639.E9CA2000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00008056.00000000.305639.E9CA2000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008056.00000000.305639.E9CA2000.00000002.mdmp47:T2515,"msedgewebview2.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fffeb0e0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff815ce0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff815ce0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ff815ce0000 "msedgewebview2.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ff815a80000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff815ce0000 "msedgewebview2.exe" loaded module "KERNEL32" at base 7ff816d50000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff815ce0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff815ce0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff815ce0000 "msedgewebview2.exe" loaded module "VERSION.DLL" at base 7ff80b7a0000 "msedgewebview2.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 7ff817880000 "msedgewebview2.exe" loaded module "KERNEL32.DLL" at base 7ff816d50000 "msedgewebview2.exe" loaded module "ADVAPI32.DLL" at base 7ff817ec0000 "msedgewebview2.exe" loaded module "RPCRT4.DLL" at base 7ff8181f0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 7ff814900000 "msedgewebview2.exe" loaded module "NTMARTA.DLL" at base 7ff814900000 "msedgewebview2.exe" loaded module "USER32.DLL" at base 7ff816b60000 "msedgewebview2.exe" loaded module "NTDLL.DLL" at base 7ff818470000 "msedgewebview2.exe" loaded module "KERNELBASE" at base 7ff815ce0000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\144.0.3719.115\MSEDGE.DLL" at base 7fffcf050000 "msedgewebview2.exe" loaded module "KBDUS.DLL" at base 7ff806320000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff812ea0000 "msedgewebview2.exe" loaded module "OLE32.DLL" at base 7ff817a80000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff8167d0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff8167d0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.PROFILE.PLATFORMDIAGNOSTICSANDUSAGEDATASETTINGS.DLL" at base 7ffffa190000 "msedgewebview2.exe" loaded module "POLICYMANAGER.DLL" at base 7ff80db40000 "msedgewebview2.exe" loaded module "USERENV.DLL" at base 7ff814e50000 "msedgewebview2.exe" loaded module "SHLWAPI.DLL" at base 7ff8166f0000 "msedgewebview2.exe" loaded module "MDMREGISTRATION.DLL" at base 7ff8002d0000 "msedgewebview2.exe" loaded module "NETAPI32.DLL" at base 7ff80b250000 "msedgewebview2.exe" loaded module "OLEAUT32.DLL" at base 7ff817ce0000 "msedgewebview2.exe" loaded module "DWRITE.DLL" at base 7ff8117a0000 "msedgewebview2.exe" loaded module "WS2_32.DLL" at base 7ff817e40000 "msedgewebview2.exe" loaded module "SHELL32.DLL" at base 7ff816ed0000 "msedgewebview2.exe" loaded module "COMCTL32.DLL" at base 7ffffdef0000 "msedgewebview2.exe" loaded module "CRYPT32.DLL" at base 7ff815b70000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 7ffff3b00000 "msedgewebview2.exe" loaded module "IPHLPAPI.DLL" at base 7ff814400000 "msedgewebview2.exe" loaded module "GDI32.DLL" at base 7ff817e10000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff817760000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff817a80000 "msedgewebview2.exe" loaded module "DNSAPI.DLL" at base 7ff814430000 "msedgewebview2.exe" loaded module "API-MS-WIN-SHCORE-SCALING-L1-1-1.DLL" at base 7ff817880000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 7ff805530000 "msedgewebview2.exe" loaded module "WTSAPI32.DLL" at base 7ff80f1f0000 "msedgewebview2.exe" loaded module "CFGMGR32.DLL" at base 7ff815490000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.APPCORE.DLL" at base 7ff80ec00000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ff813750000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\144.0.3719.115\TELCLIENT.DLL" at base 7fffe9660000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\144.0.3719.115\ONEDS.DLL" at base 7fffe9320000 "msedgewebview2.exe" loaded module "MSCMS.DLL" at base 7ff80da80000 "msedgewebview2.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff8148e0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.DIAGNOSTICS.TELEMETRY.PLATFORMTELEMETRYCLIENT.DLL" at base 7ffff9050000 "msedgewebview2.exe" loaded module "WINHTTP.DLL" at base 7ff810320000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\CAPABILITYACCESSMANAGERCLIENT.DLL" at base 7ffffc1e0000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\144.0.3719.115\ONEAUTH.DLL" at base 7fffe8ce0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.IMMERSIVE.DLL" at base 7ff803cb0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\USERMGRPROXY.DLL" at base 7ffffff80000 "msedgewebview2.exe" loaded module "WEBAUTHN.DLL" at base 7fffebde0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WLDP.DLL" at base 7ff815080000 "msedgewebview2.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 7ff815ce0000 "msedgewebview2.exe" loaded module "IMM32.DLL" at base 7ff816d10000 "msedgewebview2.exe" loaded module "SETUPAPI.DLL" at base 7ff816270000 "msedgewebview2.exe" loaded module "BCRYPTPRIMITIVES" at base 7ff815a80000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\SHCORE.DLL" at base 7ff817880000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff814850000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\INPUTHOST.DLL" at base 7ff803550000 "msedgewebview2.exe" loaded module "DEVOBJ.DLL" at base 7ff815460000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ffffb200000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL" at base 7ff815ce0000 "msedgewebview2.exe" loaded module "WINTRUST.DLL" at base 7ff815b00000 "msedgewebview2.exe" loaded module "SECUR32.DLL" at base 7ff80a890000 "msedgewebview2.exe" loaded module "ATLTHUNK.DLL" at base 7ffff23f0000 "msedgewebview2.exe" loaded module "SSPICLI.DLL" at base 7ff814b30000 "msedgewebview2.exe" loaded module "BCRYPT.DLL" at base 7ff815170000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff815a80000 "msedgewebview2.exe" loaded module "OLEACC.DLL" at base 7ffffb450000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\DIRECTMANIPULATION.DLL" at base 7ff8029f0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SECURITY.AUTHENTICATION.WEB.CORE.DLL" at base 7ffffe680000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff8167d0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\IERTUTIL.DLL" at base 7ff807e20000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 7ff801f30000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\VAULTCLI.DLL" at base 7ffffb3d0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.WEB.DLL" at base 7ff807bf0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\AADWAMEXTENSION.DLL" at base 7ffff6f80000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\MICROSOFTACCOUNTWAMEXTENSION.DLL" at base 7fffe87e0000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff815ce0000 "msedgewebview2.exe" loaded module "COMBASE.DLL" at base 7ff8167d0000 "msedgewebview2.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\144.0.3719.115\MICROSOFT_SHELL_INTEGRATION.DLL" at base 7fffe8760000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\FLIGHTSETTINGS.DLL" at base 7ff809060000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\FCON.DLL" at base 7ff808ec0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SECURITY.AUTHENTICATION.ONLINEID.DLL" at base 7ff806f50000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ff80e5e0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffff7890000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff814d50000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff80c900000 "msedgewebview2.exe" loaded module "DBGHELP.DLL" at base 7ff80a660000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-WOW64-L1-1-2.DLL" at base 7ff815ce0000 "msedgewebview2.exe" loaded module "PSAPI.DLL" at base 7ff818160000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-VERSION-L1-1-0.DLL" at base 7ff815ce0000 "msedgewebview2.exe" loaded module "VERIFIER.DLL" at base 7fffe86e0000 "msedgewebview2.exe" loaded module "DHCPCSVC.DLL" at base 7ff810070000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff80e010000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 7ff810f80000 "msedgewebview2.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 7ff815ce0000 "msedgewebview2.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 7ff80d42000048:T451,"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "msedgewebview2.exe" touched "Ptype_PSFactory" (Path: "HKCU\CLSID\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}\TREATAS") "msedgewebview2.exe" touched "TF_InputProcessorProfiles" (Path: "HKCU\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}\TREATAS") "msedgewebview2.exe" touched "TF_ThreadMgr" (Path: "HKCU\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\TREATAS") "msedgewebview2.exe" touched "TF_CategoryMgr" (Path: "HKCU\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\TREATAS") "msedgewebview2.exe" touched "TF_DisplayAttributeMgr" (Path: "HKCU\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\TREATAS") "msedgewebview2.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\TREATAS") "msedgewebview2.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "msedgewebview2.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS")49:T115e,Process "msedgewebview2.exe" (UID: 00000000-00006572) was launched with new environment variables: "WEBVIEW2_RELEASE_CHANNEL_PREFERENCE="0"" Process "msedgewebview2.exe" (UID: 00000000-00007364) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_6572_OLYRXJHCMVDTQARA", USERDNSDOMAIN="TShAy34k2giGUB3", IS_EDGE_WEBVIEW="1", EDGE_WEBVIEW_PREFETCH_HOSTED_APP="/pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1", EDGE_BROWSER_PID="6572"" Process "msedgewebview2.exe" (UID: 00000000-00007364) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "msedgewebview2.exe" (UID: 00000000-00001340) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="0", COMPONENT_INSTALLER_DIR="%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView", EDGE_USER_DATA_DIR="%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView", EDGE_METRICS_CLIENT_ID_HASH="-7558703039381511020"" Process "msedgewebview2.exe" (UID: 00000000-00007836) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CURL_CA_BUNDLE, PATHEXT, DriverData, IS_EDGE_WEBVIEW, ProgramData, ProgramW6432, HOMEPATH, WEBVIEW2_RELEASE_CHANNEL_PREFERENCE, PROCESSOR_IDENTIFIER, EDGE_WEBVIEW_PREFETCH_HOSTED_APP, ProgramFiles, PUBLIC, windir, USERDOMAIN, LOGONSERVER, OneDrive, APPDATA, CommonProgramFiles, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, HOMEDRIVE, USERPROFILE, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS, EDGE_METRICS_CLIENT_ID_HASH" Process "msedgewebview2.exe" (UID: 00000000-00007504) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%ProgramFiles(x86)%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="0", EDGE_USER_DATA_DIR="%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView", USERNAME="HA69nTn", USERDNSDOMAIN="TShAy34k2giGUB3", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", IS_EDGE_WEBVIEW="1", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\HA69nTn", WEBVIEW2_RELEASE_CHANNEL_PREFERENCE="0", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", EDGE_WEBVIEW_PREFETCH_HOSTED_APP="/pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", windir="C:\WINDOWS", USERDOMAIN="TShAy34k2giGUB3", LOGONSERVER="\\DESKTOP-8LD9T6N", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", CommonProgramFiles="%PROGRAMFILES%\Common Files", OS="Windows_NT", COMPUTERNAME="TShAy34k2giGUB3", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", HOMEDRIVE="C:", USERPROFILE="C:\Users\HA69nTn", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", NUMBER_OF_PROCESSORS="8", EDGE_METRICS_CLIENT_ID_HASH="-7558703039381511020"" Process "msedgewebview2.exe" (UID: 00000000-00007116) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CURL_CA_BUNDLE, PATHEXT, DriverData, IS_EDGE_WEBVIEW, ProgramData, ProgramW6432, HOMEPATH, WEBVIEW2_RELEASE_CHANNEL_PREFERENCE, PROCESSOR_IDENTIFIER, EDGE_WEBVIEW_PREFETCH_HOSTED_APP, ProgramFiles, PUBLIC, windir, USERDOMAIN, LOGONSERVER, OneDrive, APPDATA, CommonProgramFiles, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, HOMEDRIVE, USERPROFILE, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS, EDGE_METRICS_CLIENT_ID_HASH"4a:T98f,"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "msedgewebview2.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS-CZ") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS-CZ") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DA-DK") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DA-DK") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DE-DE") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DE-DE") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EL-GR") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EL-GR") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-ES_TRADNL") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-ES_TRADNL") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FI-FI") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FI-FI") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FR-FR") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FR-FR") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "HU-HU") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "HU-HU") "msedgewebview2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "IT-IT")4b:T96e,Spawned process "msedgewebview2.exe" with commandline "--embedded-browser-webview=1 --webview-exe-name=7169885e9230836c ..." (UID: 00000000-00006572) Spawned process "msedgewebview2.exe" with commandline "--type=crashpad-handler --user-data-dir=%APPDATA%\\7169885e92308 ..." (UID: 00000000-00007364) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\71 ..." (UID: 00000000-00001340), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006372), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007836), Spawned process "msedgewebview2.exe" with commandline "--type=renderer --noerrdialogs --user-data-dir="C:\\Users\\HA69n ..." (UID: 00000000-00002160) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\71 ..." (UID: 00000000-00007504), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007116), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\71 ..." (UID: 00000000-00008056) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005572) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\71 ..." (UID: 00000000-00002544), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005016), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\71 ..." (UID: 00000000-00006288) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004380) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\71 ..." (UID: 00000000-00007660), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002008)4c:T96e,Spawned process "msedgewebview2.exe" with commandline "--embedded-browser-webview=1 --webview-exe-name=7169885e9230836c ..." (UID: 00000000-00006572) Spawned process "msedgewebview2.exe" with commandline "--type=crashpad-handler --user-data-dir=%APPDATA%\\7169885e92308 ..." (UID: 00000000-00007364) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\71 ..." (UID: 00000000-00001340), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006372), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007836), Spawned process "msedgewebview2.exe" with commandline "--type=renderer --noerrdialogs --user-data-dir="C:\\Users\\HA69n ..." (UID: 00000000-00002160) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\71 ..." (UID: 00000000-00007504), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007116), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\71 ..." (UID: 00000000-00008056) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005572) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\71 ..." (UID: 00000000-00002544), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005016), Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\71 ..." (UID: 00000000-00006288) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004380) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\71 ..." (UID: 00000000-00007660), Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002008)4d:T51e,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp")4e:T571a,"0b50d14e-6713-41f2-9197-30ff6ff07a80.dmp" has type "Mini DuMP crash report 16 streams Fri Oct 16 02:26:00 2026 0x61965 type"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\reports\0b50d14e-6713-41f2-9197-30ff6ff07a80.dmp]- [targetUID: 00000000-00007364] "data_1" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\GPUCache\data_1]- [targetUID: 00000000-00006572] "index" has type "FoxPro FPT blocks size 768 next free block index 3284796353 field type 0"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\DawnWebGPUCache\index]- [targetUID: 00000000-00006372] "index" has type "FoxPro FPT blocks size 768 next free block index 3284796353 field type 0"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\DawnGraphiteCache\index]- [targetUID: 00000000-00006372] "index" has type "FoxPro FPT blocks size 768 next free block index 3284796353 field type 0"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\GPUCache\index]- [targetUID: 00000000-00006372] "index" has type "FoxPro FPT blocks size 768 next free block index 3284796353 field type 0"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\index]- [targetUID: 00000000-00006372] "Web Data" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 3 database pages 108 cookie 0x42 schema 4 UTF-8 version-valid-for 3"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Web Data]- [targetUID: 00000000-00006572] "History" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 50 cookie 0x2a schema 4 UTF-8 version-valid-for 2"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\History]- [targetUID: 00000000-00006572] "db" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 11 cookie 0x8 schema 4 UTF-8 version-valid-for 2"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Shared Dictionary\db]- [targetUID: 00000000-00006372] "sslkey.txt" has type "ASCII text"- Location: [%TEMP%\sslkey.txt]- [targetUID: 00000000-00006372] "Login Data" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 21 cookie 0xc schema 4 UTF-8 version-valid-for 1"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Login Data]- [targetUID: 00000000-00006572] "Trust Tokens" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 9 cookie 0x5 schema 4 UTF-8 version-valid-for 2"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\Trust Tokens]- [targetUID: 00000000-00006372] "Reporting and NEL" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 4 database pages 9 cookie 0x4 schema 4 UTF-8 version-valid-for 4"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\Reporting and NEL]- [targetUID: 00000000-00006372] "Vpn Tokens" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 7 cookie 0x4 schema 4 UTF-8 version-valid-for 2"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Vpn Tokens]- [targetUID: 00000000-00006572] "Safe Browsing Cookies" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 7 database pages 5 cookie 0x5 schema 4 UTF-8 version-valid-for 7"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies]- [targetUID: 00000000-00006372] "ServerCertificate" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 1 database pages 5 cookie 0x2 schema 4 UTF-8 version-valid-for 1"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\ServerCertificate]- [targetUID: 00000000-00006572] "Favicons" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 10 cookie 0x8 schema 4 UTF-8 version-valid-for 1"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Favicons]- [targetUID: 00000000-00006572] "88530ea3-1d84-4492-86a8-4bd30e6eebc4.tmp" has type "JSON text data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\88530ea3-1d84-4492-86a8-4bd30e6eebc4.tmp]- [targetUID: 00000000-00006572] "data_2" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\data_2]- [targetUID: 00000000-00006572] "data_0" has type "FoxPro FPT blocks size 512 next free block index 3284796609 field type 0"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\DawnGraphiteCache\data_0]- [targetUID: 00000000-00006572] "data_3" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\DawnGraphiteCache\data_3]- [targetUID: 00000000-00006572] "e3ebe5a9-8d85-498d-a904-39eb1d2ef440.tmp" has type "JSON text data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\e3ebe5a9-8d85-498d-a904-39eb1d2ef440.tmp]- [targetUID: 00000000-00006572] "2c9bf446-8dab-4854-ae9f-7e4c49574432.tmp" has type "JSON text data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\2c9bf446-8dab-4854-ae9f-7e4c49574432.tmp]- [targetUID: 00000000-00006572] "Edge-Local-State-Tmp-adafb66e-97fc-46ec-bc9e-befcace80994.tmp" has type "JSON text data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-adafb66e-97fc-46ec-bc9e-befcace80994.tmp]- [targetUID: 00000000-00006572] "SharedStorage" has type "SQLite 3.x database last written using SQLite version 3050004 writer version 2 read version 2 file counter 1 database pages 1 cookie 0 schema 0 unknown 0 encoding version-valid-for 1"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\SharedStorage]- [targetUID: 00000000-00006572] "Edge-Local-State-Tmp-369a3029-f5b9-4c81-8c01-7f9f0918b57a.tmp" has type "JSON text data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-369a3029-f5b9-4c81-8c01-7f9f0918b57a.tmp]- [targetUID: 00000000-00006572] "Edge-Local-State-Tmp-e1f00d4e-7ae9-4f3d-a4cd-140e666908e0.tmp" has type "JSON text data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-e1f00d4e-7ae9-4f3d-a4cd-140e666908e0.tmp]- [targetUID: 00000000-00006572] "Edge-Local-State-Tmp-76b2d190-3d46-44f3-8d93-867ffcceb31c.tmp" has type "JSON text data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-76b2d190-3d46-44f3-8d93-867ffcceb31c.tmp]- [targetUID: 00000000-00006572] "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres]- [targetUID: 00000000-00006572] "8ae9f0c30ea1668425d0f7d6255d597ead710776.tbres" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\TokenBroker\Cache\8ae9f0c30ea1668425d0f7d6255d597ead710776.tbres]- [targetUID: 00000000-00006572] "Edge-Local-State-Tmp-eccaa385-d549-424a-8f96-148c3e2a2bbf.tmp" has type "JSON text data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-eccaa385-d549-424a-8f96-148c3e2a2bbf.tmp]- [targetUID: 00000000-00006572] "watson_metadata" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\watson_metadata]- [targetUID: 00000000-00007364] "SharedStorage-journal" has type "SQLite Rollback Journal"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\SharedStorage-journal]- [targetUID: 00000000-00006572] "000003.log" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_proto_db\metadata\000003.log]- [targetUID: 00000000-00006572] "LOG" has type "ASCII text"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Site Characteristics Database\LOG]- [targetUID: 00000000-00006572] "LOG" has type "ASCII text"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_proto_db\metadata\LOG]- [targetUID: 00000000-00006572] "LOG" has type "ASCII text"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Sync Data\LevelDB\LOG]- [targetUID: 00000000-00006572] "LOG" has type "ASCII text"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension Scripts\LOG]- [targetUID: 00000000-00006572] "LOG" has type "ASCII text"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension State\LOG]- [targetUID: 00000000-00006572] "LOG" has type "ASCII text"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_proto_db\LOG]- [targetUID: 00000000-00006572] "LOG" has type "ASCII text"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension Rules\LOG]- [targetUID: 00000000-00006572] "settings.dat" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\settings.dat]- [targetUID: 00000000-00006572] "d73c28ba6a34bf0e_0" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache\js\d73c28ba6a34bf0e_0]- [targetUID: 00000000-00006572] "1afe9cacc9803fd2_0" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache\js\1afe9cacc9803fd2_0]- [targetUID: 00000000-00006572] "README" has type "ASCII text with no line terminators"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\README]- [targetUID: 00000000-00006572] "000003.log" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension State\000003.log]- [targetUID: 00000000-00006572] "temp-index" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00006372] "Variations" has type "JSON text data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Variations]- [targetUID: 00000000-00006572] "000003.log" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Sync Data\LevelDB\000003.log]- [targetUID: 00000000-00006572] "483c491c-cc61-4bd9-a4da-ccaba1cad878.tmp" has type "JSON text data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\483c491c-cc61-4bd9-a4da-ccaba1cad878.tmp]- [targetUID: 00000000-00006372] "temp-index" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Shared Dictionary\cache\index-dir\temp-index]- [targetUID: 00000000-00006372] "temp-index" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache\wasm\index-dir\temp-index]- [targetUID: 00000000-00006372] "MANIFEST-000001" has type "OpenPGP Secret Key"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension Scripts\MANIFEST-000001]- [targetUID: 00000000-00006572] "000003.log" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Site Characteristics Database\000003.log]- [targetUID: 00000000-00006572] "e79ff55a-db59-495f-abe8-dd02900ec933.tmp" has type "JSON text data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\e79ff55a-db59-495f-abe8-dd02900ec933.tmp]- [targetUID: 00000000-00006372] "000003.log" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension Scripts\000003.log]- [targetUID: 00000000-00006572] "index" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Shared Dictionary\cache\index]- [targetUID: 00000000-00006372] "throttle_store.dat" has type "ASCII text"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\throttle_store.dat]- [targetUID: 00000000-00006572] "000003.log" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_proto_db\000003.log]- [targetUID: 00000000-00006572] "000001.dbtmp" has type "ASCII text"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp]- [targetUID: 00000000-00006572] "metadata" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\metadata]- [targetUID: 00000000-00007364] "Last Version" has type "ASCII text with no line terminators"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Last Version]- [targetUID: 00000000-00006572] "7aa00a64-f88b-4edf-a0f8-8cbee0b3943b.tmp" has type "JSON text data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\component_crx_cache\7aa00a64-f88b-4edf-a0f8-8cbee0b3943b.tmp]- [targetUID: 00000000-00006572] "57028a7a-a954-4ead-8cfd-b879b45ae314.tmp" has type "JSON text data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\57028a7a-a954-4ead-8cfd-b879b45ae314.tmp]- [targetUID: 00000000-00006372] "data_1" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\data_1]- [targetUID: 00000000-00006572] "data_1" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\DawnWebGPUCache\data_1]- [targetUID: 00000000-00006572] "data_1" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\DawnGraphiteCache\data_1]- [targetUID: 00000000-00006572] "Login Data For Account" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 21 cookie 0xc schema 4 UTF-8 version-valid-for 1"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Login Data For Account]- [targetUID: 00000000-00006572] "Cookies" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 7 database pages 5 cookie 0x5 schema 4 UTF-8 version-valid-for 7"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\Cookies]- [targetUID: 00000000-00006372] "data_0" has type "FoxPro FPT blocks size 512 next free block index 3284796609 field type 0"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\DawnWebGPUCache\data_0]- [targetUID: 00000000-00006572] "data_2" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\DawnGraphiteCache\data_2]- [targetUID: 00000000-00006572] "data_3" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\DawnWebGPUCache\data_3]- [targetUID: 00000000-00006572] "data_3" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\GPUCache\data_3]- [targetUID: 00000000-00006572] "data_0" has type "FoxPro FPT blocks size 512 next free block index 3284796609 field type 0"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\data_0]- [targetUID: 00000000-00006572] "data_2" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\GPUCache\data_2]- [targetUID: 00000000-00006572] "data_0" has type "FoxPro FPT blocks size 512 next free block index 3284796609 field type 0"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\GPUCache\data_0]- [targetUID: 00000000-00006572] "data_3" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\data_3]- [targetUID: 00000000-00006572] "data_2" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\DawnWebGPUCache\data_2]- [targetUID: 00000000-00006572] "MANIFEST-000001" has type "OpenPGP Secret Key"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension State\MANIFEST-000001]- [targetUID: 00000000-00006572] "MANIFEST-000001" has type "OpenPGP Secret Key"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001]- [targetUID: 00000000-00006572] "MANIFEST-000001" has type "OpenPGP Secret Key"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_proto_db\MANIFEST-000001]- [targetUID: 00000000-00006572] "MANIFEST-000001" has type "OpenPGP Secret Key"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension Rules\MANIFEST-000001]- [targetUID: 00000000-00006572] "MANIFEST-000001" has type "OpenPGP Secret Key"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001]- [targetUID: 00000000-00006572] "MANIFEST-000001" has type "OpenPGP Secret Key"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001]- [targetUID: 00000000-00006572] "000003.log" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension Rules\000003.log]- [targetUID: 00000000-00006572] "index" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache\js\index]- [targetUID: 00000000-00006372] "index" has type "data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache\wasm\index]- [targetUID: 00000000-00006372] "000001.dbtmp" has type "ASCII text"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp]- [targetUID: 00000000-00006572] "000001.dbtmp" has type "ASCII text"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension Scripts\000001.dbtmp]- [targetUID: 00000000-00006572] "000001.dbtmp" has type "ASCII text"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_proto_db\000001.dbtmp]- [targetUID: 00000000-00006572] "000001.dbtmp" has type "ASCII text"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Site Characteristics Database\000001.dbtmp]- [targetUID: 00000000-00006572] "000001.dbtmp" has type "ASCII text"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension State\000001.dbtmp]- [targetUID: 00000000-00006572] "000001.dbtmp" has type "ASCII text"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension Rules\000001.dbtmp]- [targetUID: 00000000-00006572] "7c456974-d527-4809-864e-b2e9e99f2498.tmp" has type "JSON text data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\7c456974-d527-4809-864e-b2e9e99f2498.tmp]- [targetUID: 00000000-00006372] "f1caf4f4-221e-4889-bac5-5b752a534b09.tmp" has type "JSON text data"- Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\f1caf4f4-221e-4889-bac5-5b752a534b09.tmp]- [targetUID: 00000000-00006372]4f:Td00,"88530ea3-1d84-4492-86a8-4bd30e6eebc4.tmp" has type "JSON text data" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\88530ea3-1d84-4492-86a8-4bd30e6eebc4.tmp] "e3ebe5a9-8d85-498d-a904-39eb1d2ef440.tmp" has type "JSON text data" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\e3ebe5a9-8d85-498d-a904-39eb1d2ef440.tmp] "2c9bf446-8dab-4854-ae9f-7e4c49574432.tmp" has type "JSON text data" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\2c9bf446-8dab-4854-ae9f-7e4c49574432.tmp] "Edge-Local-State-Tmp-adafb66e-97fc-46ec-bc9e-befcace80994.tmp" has type "JSON text data" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-adafb66e-97fc-46ec-bc9e-befcace80994.tmp] "Edge-Local-State-Tmp-369a3029-f5b9-4c81-8c01-7f9f0918b57a.tmp" has type "JSON text data" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-369a3029-f5b9-4c81-8c01-7f9f0918b57a.tmp] "Edge-Local-State-Tmp-e1f00d4e-7ae9-4f3d-a4cd-140e666908e0.tmp" has type "JSON text data" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-e1f00d4e-7ae9-4f3d-a4cd-140e666908e0.tmp] "Edge-Local-State-Tmp-76b2d190-3d46-44f3-8d93-867ffcceb31c.tmp" has type "JSON text data" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-76b2d190-3d46-44f3-8d93-867ffcceb31c.tmp] "Edge-Local-State-Tmp-eccaa385-d549-424a-8f96-148c3e2a2bbf.tmp" has type "JSON text data" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-eccaa385-d549-424a-8f96-148c3e2a2bbf.tmp] "483c491c-cc61-4bd9-a4da-ccaba1cad878.tmp" has type "JSON text data" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\483c491c-cc61-4bd9-a4da-ccaba1cad878.tmp] "e79ff55a-db59-495f-abe8-dd02900ec933.tmp" has type "JSON text data" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\e79ff55a-db59-495f-abe8-dd02900ec933.tmp] "7aa00a64-f88b-4edf-a0f8-8cbee0b3943b.tmp" has type "JSON text data" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\component_crx_cache\7aa00a64-f88b-4edf-a0f8-8cbee0b3943b.tmp] "57028a7a-a954-4ead-8cfd-b879b45ae314.tmp" has type "JSON text data" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\57028a7a-a954-4ead-8cfd-b879b45ae314.tmp] "7c456974-d527-4809-864e-b2e9e99f2498.tmp" has type "JSON text data" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\7c456974-d527-4809-864e-b2e9e99f2498.tmp] "f1caf4f4-221e-4889-bac5-5b752a534b09.tmp" has type "JSON text data" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\f1caf4f4-221e-4889-bac5-5b752a534b09.tmp]50:T797,"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")51:T127e,"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSLEEPLOOPWINDOWSIZE"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSPINCOUNTTHRESHOLD"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYBASEYIELD"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTFACTORYIELD"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYMAXYIELD"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F3A71A4B-6118-4257-8CCB-39A33BA059D4"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "STE"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "D0F1A5C6-FC43-48AE-99BF-EFB1C38BE9D1"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "")52:T8e9,"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to touch file "\Device\CNG" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to touch file "C:\WINDOWS\SYSTEM32\powrprof.dll" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to touch file "C:\Windows\System32\powrprof.dll" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to touch file "C:\WINDOWS\SYSTEM32\UMPDC.dll" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to touch file "C:\Windows\System32\umpdc.dll" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to touch file "C:\Windows\System32\imm32.dll" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to touch file "C:\WINDOWS\system32\oleaut32.dll" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to touch file "C:\Windows\System32\oleaut32.dll" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to touch file "C:\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe.Local\" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to touch file "C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_270f70857386168e\comctl32.dll" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_270f70857386168e\comctl32.dll" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to touch file "C:\WINDOWS\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.22621.1635_none_57fa636ace18905c\gdiplus.dll" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.22621.1635_none_57fa636ace18905c\GdiPlus.dll"53:Tca0,"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to access non-existent file "C:\dwmapi.dll" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to access non-existent file "C:\VERSION.dll" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to access non-existent file "C:\PROPSYS.dll" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to access non-existent file "C:\imageres.dll" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\FLTLIB.DLL" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\CRYPTSP.DLL" "msedgewebview2.exe" trying to access non-existent file "C:\Users\HA69nTn\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\WINMM.dll" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\KBDUS.DLL" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\wkscli.dll" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\netutils.dll" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\MDMRegistration.dll" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msvcp110_win.dll" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\omadmapi.dll" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\netapi32.dll" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\SAMCLI.DLL" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\DSREG.DLL" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\profapi.dll" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\MSASN1.dll" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\UMPDC.dll" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\cfgmgr32.dll" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\dbghelp.dll" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\mscms.dll"54:Tf54,"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to access non-existent file "C:\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe.Local\" "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "msedgewebview2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\throttle_store.dat" "msedgewebview2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\settings.dat" "msedgewebview2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\BrowserMetrics" "msedgewebview2.exe" trying to access non-existent file "C:\Users\HA69nTn\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\BrowserMetrics" "msedgewebview2.exe" trying to access non-existent file "C:\Users\HA69nTn\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\BrowserMetrics\BrowserMetrics-6AD17A94-19AC.pma" "msedgewebview2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\BrowserMetrics\BrowserMetrics-6AD17A94-19AC.pma" "msedgewebview2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\BrowserMetrics-spare.pma" "msedgewebview2.exe" trying to access non-existent file "C:\Users\HA69nTn\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Local State" "msedgewebview2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Local State" "msedgewebview2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Variations" "msedgewebview2.exe" trying to access non-existent file "C:\Users\HA69nTn\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Variations" "msedgewebview2.exe" trying to access non-existent file "C:\Users\HA69nTn\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\VariationsSafeSeedV1" "msedgewebview2.exe" trying to access non-existent file "C:\Users\HA69nTn\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\VariationsRuntimeSeedV1" "msedgewebview2.exe" trying to access non-existent file "C:\Users\HA69nTn\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\VariationsSeedV1" "msedgewebview2.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe.Local\" "msedgewebview2.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}" "msedgewebview2.exe" trying to access non-existent file "C:\Users\HA69nTn\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\component_crx_cache" "msedgewebview2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\component_crx_cache\metadata.json" "msedgewebview2.exe" trying to access non-existent file "C:\Users\HA69nTn\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\component_crx_cache\metadata.json"55:T76a,"msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\throttle_store.dat" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\settings.dat" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Site Characteristics Database\000001.dbtmp" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Extension Rules\000001.dbtmp" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_proto_db\metadata\000003.log" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\shared_proto_db\000001.dbtmp" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Site Characteristics Database\000003.log" "msedgewebview2.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Sync Data\LevelDB\000003.log"56:Td66,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00007364-00000C2C-3478989714") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00007364-00000C2C-3479072277") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00007364-00000C2C-3479072455") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00007364-00000C2C-3479072455") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00007364-00000C2C-3479072455") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00007364-00000C2C-3479073062") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00007364-00000C2C-3479073062") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00006372-00000C2C-3431417103") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00006372-00000C2C-3431417478") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00006372-00000C2C-3433145187") Found reference to API "edgeInternetConnectivityPrivate" (Indicator: "InternetConnect"; Source: "00000000-00002160.00000000.305187.0005C000.00000004.mdmp, 00000000-00002160.00000000.305187.0014C000.00000004.mdmp, 00000000-00002160.00000000.305187.005C8000.00000004.mdmp, 00000000-00002160.00000001.307105.0005C000.00000004.mdmp, 00000000-00002160.00000002.309025.0014C000.00000004.mdmp, 00000000-00002160.00000002.309025.005C8000.00000004.mdmp, 00000000-00002160.00000003.309414.0005C000.00000004.mdmp, 00000000-00002160.00000003.309414.0014C000.00000004.mdmp, 00000000-00002160.00000003.309414.005C8000.00000004.mdmp") Found reference to API "permission:edgeInternetConnectivityPrivate" (Indicator: "InternetConnect"; Source: "00000000-00002160.00000000.305187.00554000.00000004.mdmp, 00000000-00002160.00000001.307105.00554000.00000004.mdmp, 00000000-00002160.00000002.309025.00554000.00000004.mdmp, 00000000-00002160.00000003.309414.00554000.00000004.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp")57:T75e,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp")58:Tba0,file/memory contains long string with (Indicator: " connect "; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 day and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found reference to API "other {This device will be saved for {DAYS} days and you can connect without a code next time. This is set by your administrator.}}{HOURS, plural," (Indicator: " connect "; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 hour and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found reference to API "other {This device will be saved for {HOURS} hours and you can connect without a code next time. This is set by your administrator.}}{MONTHS, plural," (Indicator: " connect "; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 month and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found reference to API "other {This device will be saved for {MONTHS} months and you can connect without a code next time. This is set by your administrator.}}{YEARS, plural," (Indicator: " connect "; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 year and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") file/memory contains long string with (Indicator: " bind "; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found reference to API "USB device from $2 (product $1)USB devices from $1USB device ($2:$1)USB devices from vendor $1Any serial port$1 wants to connect to a HID deviceUnknown Device ($1)Finding HID devices" (Indicator: " connect "; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found reference to API "your organization requires Microsoft Edge to connect to the Internet and" (Indicator: " connect "; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found reference to API "t use a secure connection this time. An attacker might be trying to eavesdrop or modify your network connection. $1You usually connect to sites securely, but Microsoft Edge couldn" (Indicator: " connect "; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found reference to API "forged shutdown request, got:" (Indicator: " shutdown "; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp")59:T9853,Pattern match: "http://wails.localhost/;http://wails.localhost/eindexsetabledownloadsdownloadscreate" Pattern match: "https://*excel.officeapps.live.com/*,https://*onenote.officeapps.live.com/*,https://*powerpoint.officeapps.live.com/*,https://*word-edit.officeapps.live.com/*,https://*excel.officeapps.live.com.mcas.ms/*,https://*onenote.officeapps.live.com.mcas." Pattern match: "http://[*.]wails.localhost,*:{last_modified:13436587562135297,setting:{}}},cookies:{},direct_sockets:{},direct_sockets_private_network_access:{},display_media_system_audio:{},disruptive_notification_permissions:{},durable_storage:{},edg" Pattern match: "http://wails.localhost/" Pattern match: "http://wails.localhost/+-k?jj" Heuristic match: "config.edge.skype.com" Heuristic match: "chromewebstore.google.com" Pattern match: "http://wails.localhost/favicon.ico" Heuristic match: "outlook.live.com" Heuristic match: "rewards.bing.com" Heuristic match: "translator.bing.com" Pattern match: "www.bing.com" Pattern match: "https://www.bing.com/*" Heuristic match: "bing.com" Pattern match: "https://bing.com/*" Heuristic match: "outlook.com" Pattern match: "https://outlook.com/*" Pattern match: "www.msn.com" Pattern match: "https://www.msn.com/*" Pattern match: "www.msn.cn" Pattern match: "https://www.msn.cn/*" Heuristic match: "microsoftstart.msn.com" Heuristic match: "microsoftstart.msn.cn" Pattern match: "www.microsoftnews.com" Pattern match: "www.microsoftnews.cn" Heuristic match: "int.msn.cn" Pattern match: "https://int.msn.cn/*" Heuristic match: "int1.msn.com" Pattern match: "https://int1.msn.com/*" Heuristic match: "int.msn.com" Pattern match: "https://int.msn.com/*" Pattern match: "https://localhost/*" Pattern match: "http://localhost/*" Heuristic match: "ntp.msn.cn" Pattern match: "https://ntp.msn.cn/*" Heuristic match: "ntp.msn.com" Pattern match: "https://ntp.msn.com/*" Heuristic match: "localhost.msn.com" Heuristic match: "int1.msn.cn" Pattern match: "https://int1.msn.cn/*" Heuristic match: "copilot-stg.com" Pattern match: "http://wails.localhost" Pattern match: "http://wails.localhost/,domainandregistry:wails.localhost,securityorigin:http://wails.localhost,etypei" Pattern match: "https://chrome.google.com/webstore" Pattern match: "https://chromewebstore.google.com/" Heuristic match: "translatorserp.bing.com" Pattern match: "https://easyauth.edgebrowser.microsoft-testing-falcon.io/*" Pattern match: "https://easyauth.edgebrowser.microsoft-staging-falcon.io/*" Heuristic match: "link.mo" Heuristic match: "blink.net" Pattern match: "a.xyz/max(a.w,.0001),a.w" Pattern match: "http://wails.localhost/assets/index-zkudzv28.js" Pattern match: "http://wails.localhost/wails/ipc.js" Pattern match: "http://wails.localhost/assets/index-dxtdw_vv.css" Pattern match: "http://wails.localhost/wails/runtime.js" Pattern match: "https://*.whiteboard.office365.us/*" Pattern match: "https://*.whiteboard.office.com/*" Pattern match: "https://*.dod.online.office365.us/*" Pattern match: "https://*.gov.online.office365.us/*" Pattern match: "https://*.partner.officewebapps.cn/*" Pattern match: "https://*.officeapps.live.com.mcas.ms/*" Pattern match: "https://*.officeapps.live.com/*" Pattern match: "https://*onenote.officeapps.live.com/*" Pattern match: "https://*excel.officeapps.live.com/*" Pattern match: "https://localhost.msn.com/*" Pattern match: "https://www.staging-bing-int.com/*" Pattern match: "www.staging-bing-int.com" Pattern match: "https://microsoftstart.msn.com/*" Pattern match: "https://microsoftstart.msn.cn/*" Pattern match: "https://www.microsoftnews.com/*" Pattern match: "https://www.microsoftnews.cn/*" Pattern match: "https://rewards.microsoft.com/*" Pattern match: "https://outlook.live.com/*" Pattern match: "https://rewards.bing.com/*" Pattern match: "https://translatorserp.bing.com/*" Pattern match: "https://translator.bing.com/*" Pattern match: "https://m365.cloud.microsoft/*" Pattern match: "https://copilot.microsoft.com/*" Pattern match: "www.office.com" Pattern match: "https://copilotstaging.microsoft.com/*" Pattern match: "https://copilot-stg.com/*" Pattern match: "https://www.microsoft.com/*/edge*" Pattern match: "https://edgecompanion.msn.cn/*" Pattern match: "https://edgecompanion.msn.com/*" Pattern match: "https://www.microsoft.com/*/bing*" Pattern match: "https://www.microsoft.com/" Pattern match: "https://reactjs.org/docs/error-decoder.html?invariant=+e,n=1;n" Pattern match: "http://www.w3.org/2000/svg;casemath:returnhttp://www.w3.org/1998/math/mathml;default:returnhttp://www.w3.org/1999/xhtml}}function" Pattern match: "http://www.w3.org/1999/xhtml&&(e=vs(n)),e===http://www.w3.org/1999/xhtml?n===script" Heuristic match: "qndow.ch" Heuristic match: "gndow.ch" Pattern match: "http://www.w3.org/1999/xhtml" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/1998/math/mathml" Pattern match: "http://wails.localhost/wails/ipc.js.0atedprefcp" Pattern match: "https://html.spec.whatwg.org/multipage/rendering.html#lists" Pattern match: "https://*powerpoint.officeapps.live.com/*" Pattern match: "https://*word-edit.officeapps.live.com/*" Pattern match: "https://*excel.officeapps.live.com.mcas.ms/*" Pattern match: "https://*onenote.officeapps.live.com.mcas.ms/*" Pattern match: "https://*word-edit.officeapps.live.com.mcas.ms/*" Pattern match: "https://*excel.partner.officewebapps.cn/*" Pattern match: "https://*onenote.partner.officewebapps.cn/*" Pattern match: "https://*powerpoint.partner.officewebapps.cn/*" Pattern match: "https://*word-edit.partner.officewebapps.cn/*" Pattern match: "https://*excel.gov.online.office365.us/*" Pattern match: "https://*excel.dod.online.office365.us/*" Pattern match: "https://*word-edit.gov.online.office365.us/*" Pattern match: "https://*powerpoint.gov.online.office365.us/*" Pattern match: "https://*onenote.gov.online.office365.us/*" Pattern match: "https://*.dev.whiteboard.microsoft.com/*" Pattern match: "https://*.app.int.whiteboard.microsoft.com/*" Pattern match: "https://*.app.whiteboard.microsoft.com/*" Pattern match: "https://*visio.dod.online.office365.us/*" Pattern match: "https://*visio.gov.online.office365.us/*" Pattern match: "https://*visio.partner.officewebapps.cn/*" Pattern match: "https://*word-edit.dod.online.office365.us/*" Pattern match: "https://*powerpoint.dod.online.office365.us/*" Pattern match: "https://*onenote.dod.online.office365.us/*" Pattern match: "https://copilot.cloud.microsoft/*" Pattern match: "https://sbrprodprv.www.office.com/chat/*" Pattern match: "https://scuprodprv.m365.cloud.microsoft/*" Pattern match: "https://account.microsoft.com/account/account/*" Pattern match: "https://www.microsoft.com/*/getting-started*" Heuristic match: "easyauth.edgebrowser.microsoft-falcon.io" Heuristic match: "easyauth.edgebrowser.microsoft-staging-falcon.io" Pattern match: "https://easyauth.edgebrowser.microsoft-falcon.io/*" Heuristic match: "easyauth.edgebrowser.microsoft-testing-falcon.io" Heuristic match: "cn.bing.com" Pattern match: "https://cn.bing.com/*" Pattern match: "https://edge-auth.microsoft.com/*" Heuristic match: "partner.officewebapps.cn" Heuristic match: "officeapps.live.com.mcas.ms" Heuristic match: "whiteboard.office.com" Heuristic match: "officeapps.live.com" Heuristic match: "runtime.id" Heuristic match: "whiteboard.office365.us" Heuristic match: "gov.online.office365.us" Heuristic match: "dod.online.office365.us" Pattern match: "https://permanently-removed.invalid/" Pattern match: "http://permanently-removed.invalid/" Pattern match: "https://permanently-removed.invalid/signin/chrome/sync?ssp=1" Pattern match: "https://permanently-removed.invalid/embedded/reauth/chromeos" Pattern match: "https://permanently-removed.invalid/embedded/setup/windows" Pattern match: "https://permanently-removed.invalid/embedded/setup/v2/chromeos" Pattern match: "https://permanently-removed.invalid/v1/issuetoken" Pattern match: "https://permanently-removed.invalid/reauth/v1beta/users/" Pattern match: "https://permanently-removed.invalid/oauth2/v1/userinfo" Pattern match: "https://permanently-removed.invalid/oauth2/v2/tokeninfo" Pattern match: "https://permanently-removed.invalid/oauth2/v4/token" Pattern match: "https://permanently-removed.invalid/o/oauth2/revoke" Pattern match: "https://permanently-removed.invalid/rotateboundcookies" Pattern match: "https://permanently-removed.invalid/getcheckconnectioninfo" Pattern match: "https://permanently-removed.invalid/embedded/xreauth/chrome" Pattern match: "https://permanently-removed.invalid/oauth/multilogin" Pattern match: "https://permanently-removed.invalid/chrome/blank.html" Pattern match: "https://permanently-removed.invalid/encryption/unlock/desktop" Pattern match: "https://permanently-removed.invalid/accountchooser" Heuristic match: "ngs\core\v8\script_decoder.cc" Pattern match: "https://permanently-removed.invalid/addsession" Pattern match: "https://permanently-removed.invalid/logout" Pattern match: "https://permanently-removed.invalid/samlredirect" Pattern match: "http://permanently-removed.invalid/v1/accountcapabilities:getallvisible" Pattern match: "http://permanently-removed.invalid/v1/accountcapabilities:batchget" Pattern match: "https://permanently-removed.invalid/embedded/setup/chrome/usermenu" Pattern match: "https://permanently-removed.invalid/listaccounts?json=standard&laf=b64bin" Pattern match: "https://permanently-removed.invalid/embedded/setup/kidsignin/chromeos" Pattern match: "https://permanently-removed.invalid/embedded/setup/kidsignup/chromeos" Pattern match: "http://wails.localhostef7c4c88805d29c4bd7bf85549cf554b" Pattern match: "http://www.w3.org/1999/xlinku" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://www.w3.org/1999/xhtmlu" Pattern match: "www.office.comthumbnail" Pattern match: "go.microsoft.com/fwlink/?linkid=2093703are" Pattern match: "https://support.google.com/chromebook?p=app_intent" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2118167" Pattern match: "aka.ms/edgepreviewhttps://aka.ms/enterprisepreviewuserto" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2165400to" Pattern match: "go.microsoft.com/fwlink/?linkid=2239343https://go.microsoft.com/fwlink/?linkid=2288290show" Pattern match: "support.microsoft.com/en-us/microsoft-edge/microsoft-edge-browsing-activity-for-personalized-advertising-and-experiences-37aa831e-6372-238e-f33f-7cd3f0e53679allow" Pattern match: "www.microsoft.com/en-us/microsoft-365/family-safetyhttps://family.microsoft.com/?ref=edge://settings/familysafetyhttps://go.microsoft.com/fwlink/?linkid=2127630set" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2211966writing" Pattern match: "support.microsoft.com/office/microsoft-editor-checks-grammar-and-more-in-documents-mail-and-the-web-91ecbe1b-d021-4e9e-a82e-abc4cd7163d7are" Pattern match: "go.microsoft.com/fwlink/?linkid=2279846see" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2161865alerts" Pattern match: "go.microsoft.com/fwlink/?linkid=529732manage" Pattern match: "go.microsoft.com/fwlink/?linkid=2114187https://go.microsoft.com/fwlink/?linkid=2077327edit" Pattern match: "https://learn.microsoft.com/en-us/deployedge/edge-learnmore-reset-data-in-cloudreset" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2167671use" Pattern match: "go.microsoft.com/fwlink/?linkid=2257424keep" Pattern match: "www.microsoft.com/en-us/edge/features/real-time-video-translation?form=ma13fj&ch=1show" Pattern match: "go.microsoft.com/fwlink/?linkid=2337798https://go.microsoft.com/fwlink/?linkid=2337885explore" Pattern match: "https://microsoftedge.microsoft.com/addons" Pattern match: "https://aka.ms/edgeprintingtroubleshooting" Pattern match: "measurementlab.net/privacy" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2126235if" Pattern match: "www.bing.comtake" Pattern match: "https://www.bing.com/new/termsofuseenhanceenhance" Pattern match: "www.microsoft.com/edge/copilot-mode?form=mg0awropen" Pattern match: "https://learn.microsoft.com/en-us/copilot/privacy-and-protections#commercial-data-protectionenterprise" Pattern match: "learn.microsoft.com/en-us/microsoft-365-copilot/microsoft-365-copilot-privacy#how-does-microsoft-copilot-for-microsoft-365-use-your-proprietary-organizational-datamicrosoft's" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2107360&clcid=0x409hi" Pattern match: "http://force" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2164373" Pattern match: "microsoftedge.microsoft.com/addons?hl=enhttps://www.whatsapp.comhttps://www.facebook.comhttps://www.youtube.comhttps://www.outlook.com/81allow" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2151738" Pattern match: "http://example.com" Pattern match: "https://go.microsoft.com/fwlink/p/?linkid=2114059" Heuristic match: "t support a secure connectionattackers can see and change information you send or receive from the site.it" Pattern match: "https://go.microsoft.com/fwlink/p/\?linkid=158334https://support.microsoft.com/en-us/windows/microsoft-edge-" Pattern match: "https://support.microsoft.com/en-us/topic/protect-your-online-accounts-using-password-monitor-6f660aae-65aa-476c-871a-7fe2bcb0c4c1let's" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2193240check" Pattern match: "bing.com/work.search" Pattern match: "privacy.microsoft.com/en-us/privacystatement#mainwherewestoreandprocessdatamodulesearch" Pattern match: "go.microsoft.com/fwlink/?linkid=2189718protected" Pattern match: "https://privacy.microsoft.com/privacystatementalways" Pattern match: "https://m365.cloud.microsoft/chat?fromcode=cmm63o75lj0let's" Pattern match: "http://localhost:86/*" Pattern match: "https://docs.microsoft.com/typography" Pattern match: "https://docs.microsoft.com/typography/aboutmicrosoft" Pattern match: "http://en.wikipedia.org/wiki/mit_license" Pattern match: "https://edge.microsoft.com/extensionwebstorebase/v1/crx" Pattern match: "https://clients2.google.com/service/update2/crx" Pattern match: "http://www.monotype.com/html/designer/des_index.html" Pattern match: "http://www.monotype.com/html/mtname/ms_welcome.html" Pattern match: "http://www.microsoft.com/typography" Pattern match: "https://docs.microsoft.com/typography/about" Pattern match: "http://www.microsoft.com/typography/fonts/" Pattern match: "www.microsoft.com" Heuristic match: "edgecompanion.msn.cn" Heuristic match: "edgecompanion.msn.com" Heuristic match: "*{?.cu" Heuristic match: "realaudio sipr / acelp.net" Pattern match: "https://watson.telemetry.microsoft.com" Heuristic match: "msedge.ec" Heuristic match: "..\..\chrome\app\chrome_exe_main_win.cc" Heuristic match: "..\..\chrome\app\main_dll_loader_win.cc" Heuristic match: "..\..\chrome\common\win\edge_delay_load_notify_hook.cc" Heuristic match: "..\..\chrome\app\exit_code_watcher_win.cc" Heuristic match: "..\..\chrome\common\default_browser_channel_util_wcos.cc" Heuristic match: "!(e..\..\third_party\abseil-cpp\absl\base\internal\throw_delegate.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\strings\internal\cord_rep_btree.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\synchronization\internal\win32_waiter.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\synchronization\mutex.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\base\internal\low_level_alloc.cc" Heuristic match: "..\..\third_party\abseil-cpp\absl\log\internal\log_sink_set.cc" Heuristic match: "..\..\third_party\perfetto\src\protozero\field.cc" Heuristic match: "..\..\third_party\perfetto\src\protozero\scattered_heap_buffer.cc" Heuristic match: "..\..\third_party\perfetto\src\protozero\static_buffer.cc" Heuristic match: "?..\..\third_party\perfetto\src\base\time.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\event_context.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\internal\tracing_muxer_fake.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\null_trace_writer.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\shared_memory_abi.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\shared_memory_arbiter_impl.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\trace_writer_impl.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\edge_watson_uploader\string_table_util.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\edge_watson_uploader\throttle_store.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\edge_watson_uploader\watson_http_uploader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\edge_watson_uploader\watson_metadata.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\edge_watson_uploader\watson_report.cc" Pattern match: "https://nw-umwatson.events.data.microsoft.com/telemetry.request" Heuristic match: "..\..\third_party\crashpad\crashpad\edge_watson_uploader\secondary_data_collectors\file_collector_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\edge_watson_uploader\thread_stack_hash_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\edge_watson_uploader\watson_wer_uploader.cc" Heuristic match: "gcc..\..\third_party\crashpad\crashpad\edge_watson_uploader\win\device_ticket.cc" Pattern match: "https://crashpad.chromium.org/" Pattern match: "https://crashpad.chromium.org/bug/new" Heuristic match: "..\..\base\win\windows_version.cc" Heuristic match: "..\..\base\win\win_util.cc" Heuristic match: "..\..\base\win\resource_exhaustion.cc" Heuristic match: "..\..\base\win\registry.cc" Heuristic match: "..\..\base\time\time_win.cc" Heuristic match: "..\..\base\threading\platform_thread_win.cc" Heuristic match: "..\..\base\system\sys_info_win.cc" Heuristic match: "..\..\base\synchronization\waitable_event_win.cc" Heuristic match: "..\..\base\synchronization\condition_variable_win.cc" Heuristic match: "..\..\base\profiler\suspendable_thread_delegate_win.cc" Heuristic match: "..\..\base\process\launch_win.cc" Heuristic match: "..\..\base\native_library_win.cc" Heuristic match: "..\..\base\win\message_window.cc" Heuristic match: "..\..\base\message_loop\message_pump_win.cc" Heuristic match: "..\..\base\files\memory_mapped_file_win.cc" Heuristic match: "..\..\base\files\file_win.cc" Heuristic match: "..\..\base\win\security_util.cc" Heuristic match: "..\..\base\files\file_util_win.cc" Heuristic match: "..\..\base\files\file_enumerator_win.cc" Heuristic match: "..\..\base\file_version_info_win.cc" Heuristic match: "..\..\base\path_service.cc" Heuristic match: "..\..\base\values.cc" Heuristic match: "..\..\base\threading\thread.cc" Heuristic match: "c..\..\base\threading\scoped_blocking_call_internal.cc" Heuristic match: "..\..\base\task\thread_pool\task_tracker.cc" Heuristic match: "..\..\base\task\thread_pool\sequence.cc" Heuristic match: "..\..\base\task\thread_pool\delayed_task_manager.cc" Heuristic match: "..\..\base\task\sequence_manager\work_tracker.cc" Heuristic match: "..\..\base\task\sequence_manager\work_queue.cc" Heuristic match: "..\..\base\task\sequence_manager\task_queue_impl.cc" Heuristic match: "..\..\base\task\execution_fence.cc" Heuristic match: "..\..\base\synchronization\waitable_event.cc" Heuristic match: "0123456789abcdef..\..\base\run_loop.cc" Heuristic match: "..\..\base\profiler\thread_group_profiler.cc" Heuristic match: "..\..\base\profiler\stack_sampling_profiler.cc" Heuristic match: "..\..\base\metrics\statistics_recorder.cc" Heuristic match: "..\..\base\metrics\sparse_histogram.cc" Heuristic match: "..\..\base\metrics\persistent_memory_allocator.cc" Heuristic match: "..\..\base\metrics\histogram.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\edge_minidumpwritedump_util.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\edge_watson\memory_csv.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\edge_watson\edge_browser_session_csv.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\scoped_handle.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\process_info.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\initial_client_data.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\filesystem_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\directory_reader_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_io.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\wire_format_lite.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\repeated_field.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\message_lite.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\io\zero_copy_stream_impl_lite.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\io\zero_copy_stream.cc" Heuristic match: "..\..\third_party\protobuf\src\google\protobuf\arena.cc" Heuristic match: "..\..\mojo\public\cpp\system\simple_watcher.cc" Heuristic match: "..\..\mojo\public\c\system\thunks.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\crash_report_database_win.cc" Heuristic match: "..\..\base\win\edge_osconsent.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\settings.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\crash_report_database.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\module_version.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\net\http_transport_win.cc" Heuristic match: "..\..\third_party\zlib\google\zip_writer.cc" Heuristic match: "..\..\third_party\zlib\google\zip.cc" Heuristic match: "..\..\base\win\edge_trace_logging\trace_logging.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\prune_crash_reports.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\thread\thread_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\synchronization\semaphore_win.cc" Heuristic match: "@..\..\third_party\crashpad\crashpad\util\win\scoped_local_alloc.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\registration_protocol_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\exception_handler_server.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\scoped_set_event.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\session_end_watcher.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\misc\paths_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\scoped_process_suspend.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\win\critical_section_with_debug_info.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\client\crashpad_client_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\win\edge_minidumpwritedump_with_crashpad_info.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\win\crash_report_exception_handler.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\handler_main.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\user_stream_data_source.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\minidump_to_upload_parameters.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\file\file_seeker.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\handler\edge_watson_report_upload.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_writable.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_rva_list_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_writer_util.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_string_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_memory_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_thread_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_module_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_unloaded_module_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_handle_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\edge_minidump_thread_info_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\edge_minidump_thread_names_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_file_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_simple_string_dictionary_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_module_crashpad_info_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_context_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_byte_array_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\minidump\minidump_annotation_writer.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\system_snapshot_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\process\process_memory.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\process\process_memory_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\process_snapshot_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\process_reader_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\util\process\process_memory_range.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\process_subrange_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\pe_image_resource_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\pe_image_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\pe_image_annotations_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\module_snapshot_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\exception_snapshot_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\win\cpu_context_win.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\crashpad_types\crashpad_info_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\process_snapshot_minidump.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\module_snapshot_minidump.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\minidump_string_list_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\minidump_simple_string_dictionary_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\minidump\minidump_annotation_reader.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\memory_snapshot.cc" Heuristic match: "..\..\third_party\crashpad\crashpad\snapshot\capture_memory.cc" Heuristic match: "..\..\components\gwp_asan\crash_handler\crash_handler.cc" Heuristic match: "..\..\components\gwp_asan\common\allocator_state.cc" Heuristic match: "..\..\sandbox\win\src\sandbox_policy_base.cc" Heuristic match: "..\..\sandbox\win\src\process_mitigations.cc" Heuristic match: "..\..\sandbox\win\src\broker_services.cc" Pattern match: "https://doh.cleanbrowsing.org/doh/adult-filter{?dns" Pattern match: "https://public.dns.iij.jp/dns-query" Pattern match: "https://dns.google/dns-query{?dns" Pattern match: "https://doh.dns.sb/dns-query{?dns" Pattern match: "https://doh.cox.net/dns-query" Pattern match: "https://doh.xfinity.com/dns-query{?dns" Pattern match: "https://dns.quad9.net/dns-query" Pattern match: "https://dns10.quad9.net/dns-query" Pattern match: "https://dns11.quad9.net/dns-query" Pattern match: "https://doh.opendns.com/dns-query{?dns" Pattern match: "https://chromium.dns.nextdns.io" Pattern match: "https://dns.levonet.sk/dns-query{?dns" Heuristic match: "yieldlove-ad-serving.net" Heuristic match: "interracialpeoplemeet.com" Heuristic match: "wharfedaleobserver.co.uk" Heuristic match: "prod-adenty-cdn.azureedge.net" Heuristic match: "thedigestibledynamicspodcast.com" Heuristic match: "hearstsustainability2024.com" Heuristic match: "crimeandinvestigationplay.co.uk" Heuristic match: "northwaleschronicle.co.uk" Heuristic match: "d1cr9zxt7u0sgu.cloudfront.net" Heuristic match: "paypal-businesscenter.com" Heuristic match: "dynamics365businesscentral.com.au" Heuristic match: "telemundoareadelabahia.com" Heuristic match: "mastercardpaymentservices.com" Heuristic match: "harwichandmanningtreestandard.co.uk" Pattern match: "yandex.ru/set/s/rsya-tag-users/data" Heuristic match: "valkyrie-entertainment.com" Heuristic match: "dynamics365businesscentral.ch" Heuristic match: "thetottenhamindependent.co.uk" Heuristic match: "d2lyx5ly60ksu3.cloudfront.net" Heuristic match: "democratandchronicle.com" Heuristic match: "co.uk" Heuristic match: "collegepuzzlechallenge.com" Heuristic match: "duube1y6ojsji.cloudfront.net" Heuristic match: "eastlondonadvertiser.co.uk" Heuristic match: "americanexpresscruise.com" Heuristic match: "t.com" Pattern match: "google.com/pagead/1p-user-list" Pattern match: "yandex.ru/portal/set/any" Heuristic match: "wattonandswaffhamtimes.co.uk" Heuristic match: "enfieldindependent.co.uk" Heuristic match: "firedrumemailmarketing.com" Heuristic match: "largsandmillportnews.com" Heuristic match: "thetelegraphandargus.co.uk" Heuristic match: "prestwichandwhitefieldguide.co.uk" Heuristic match: "sonypicturestelevision-kids.com" Heuristic match: "sony-olympus-medical.com" Heuristic match: "media-rockstargames-com.akamaized.net" Heuristic match: "barkinganddagenhampost.co.uk" Heuristic match: "sobreuol.noticias.uol.com.br" Heuristic match: "helensburghadvertiser.co.uk" Heuristic match: "jsd-widget.atlassian.com" Heuristic match: "browser-intake-datadoghq.com" Heuristic match: "kidderminstershuttle.co.uk" Heuristic match: "lancashiretelegraph.co.uk" Heuristic match: "maldonandburnhamstandard.co.uk" Heuristic match: "seniorblackpeoplemeet.com" Heuristic match: "d.net" Heuristic match: "sonymusicmasterworks.com" Heuristic match: "dailymotionadvertising.com" Heuristic match: "globalinclusivegrowthsummit.com" Heuristic match: "southwalesguardian.co.uk" Heuristic match: "healthprofessionalacademy.co.uk" Heuristic match: "confiant-integrations.net" Heuristic match: "chardandilminsternews.co.uk" Heuristic match: "kangheekim-at-hearst.com" Heuristic match: "d38xvr37kwwhcm.cloudfront.net" Heuristic match: "universalorlandovacations.com" Heuristic match: "greenbaypressgazette.com" Heuristic match: "windowsforiotdevices.com" Heuristic match: "richmondandtwickenhamtimes.co.uk" Heuristic match: "stroudnewsandjournal.co.uk" Heuristic match: "paypal-knowledge-test.com" Heuristic match: "restructureinvention.com" Heuristic match: "thelancasterandmorecambecitizen.co.uk" Heuristic match: "thetfordandbrandontimes.co.uk" Heuristic match: "redhillandreigatelife.co.uk" Heuristic match: "chelmsfordweeklynews.co.uk" Heuristic match: "classificadosdorio.com.br" Heuristic match: "skynewsinternational.com" Heuristic match: "dynamics365businesscentral.ca" Heuristic match: "clactonandfrintongazette.co.uk" Heuristic match: "aliexpress-tech-open.com" Heuristic match: "swanageandwarehamvoice.co.uk" Heuristic match: "editoraglobonegocios.com.br" Heuristic match: "comcasttechnologysolutions.com" Heuristic match: "dynamics365businesscentral.be" Heuristic match: "thepointyspritesclub.com" Heuristic match: "carta-marketing-firm.co.jp" Heuristic match: "montgomeryadvertiser.com" Heuristic match: "tivysideadvertiser.co.uk" Heuristic match: "melodiouscomposition.com" Heuristic match: "publicidadeeditoraglobo.com.br" Heuristic match: "siteimproveanalytics.com" Heuristic match: "democraticpeoplemeet.com" Heuristic match: "sonypicturesanimation.com" Heuristic match: "businessofgovernment.org" Heuristic match: "blackprofessionalpeoplemeet.com" Heuristic match: "d3dn269ayoh5p6.cloudfront.net" Heuristic match: "game-advertising-online.com" Heuristic match: "brilliancepublishing.com" Heuristic match: "inflectionpointmedia.com" Heuristic match: "runcornandwidnesworld.co.uk" Heuristic match: "basingstokegazette.co.uk" Heuristic match: "constantcontactpages.com" Heuristic match: "droitwichadvertiser.co.uk" Heuristic match: "mansfieldnewsjournal.com" Heuristic match: "d1z3r0i09bwium.cloudfront.net" Heuristic match: "burlingtoncountytimes.com" Heuristic match: "saffronwaldenreporter.co.uk" Heuristic match: "bucyrustelegraphforum.com" Heuristic match: "contents-search-windows.com" Heuristic match: "sensisdigitalmedia.com.au" Heuristic match: "bordercountiesadvertizer.co.uk" Heuristic match: "investigationdiscovery.com" Heuristic match: "eppingforestguardian.co.uk" Heuristic match: "digestibledynamicspodcast.com" Heuristic match: "d1af033869koo7.cloudfront.net" Heuristic match: "sinaldigitalminas.com.br" Heuristic match: "microsoftedgeinsiders.com" Heuristic match: "tricountyindependent.com" Heuristic match: "accelerationpartners.com" Heuristic match: "d27xr6oh14aaqn.cloudfront.net" Heuristic match: "d1vg5xiq7qffdj.cloudfront.net" Heuristic match: "peterboroughmatters.co.uk" Heuristic match: "denbighshirefreepress.co.uk" Heuristic match: "classificadosautoesporte.com.br" Heuristic match: "antifraudjs.friends2follow.com" Heuristic match: "datadoghq-browser-agent.com" Heuristic match: "wymondhamandattleboroughmercury.co.uk" Heuristic match: "messengernewspapers.co.uk" Heuristic match: "braintreeandwithamtimes.co.uk" Heuristic match: "thisisthewestcountry.co.uk" Heuristic match: "universalstudioshollywood.com" Heuristic match: "universalproductsexperiences.com" Heuristic match: "dz7188oz6lnyb.cloudfront.net" Heuristic match: "marshfieldnewsherald.com" Heuristic match: "smartcaptcha.yandexcloud.net" Heuristic match: "customerservice-macys.com" Heuristic match: "nbcsportsphiladelphia.com" Heuristic match: "portclintonnewsherald.com" Heuristic match: "inquisitiveinvention.com" Heuristic match: "pxlclnmdecom-a.akamaihd.net" Heuristic match: "email-signature-image.com" Heuristic match: "zanesvilletimesrecorder.com" Heuristic match: "dynamics365businesscentral.co.nz" Heuristic match: "marriagemindedpeoplemeet.com" Heuristic match: "blackchristianpeoplemeet.com" Heuristic match: "thewestmorlandgazette.co.uk" Heuristic match: "revistacasaecomida.com.br" Heuristic match: "ncn.bing.com" Heuristic match: ".c.youtube.com" Heuristic match: ".ggpht.com" Heuristic match: ".googlevideo.com" Heuristic match: ".googleusercontent.com" Heuristic match: ".gvt1.com" Heuristic match: "rcontent.com" Heuristic match: "dgumtree.com" Heuristic match: "tband.com" Heuristic match: "cityrobotflower.com" Heuristic match: "airbnb.com.br" Heuristic match: "7fhelpscout.net" Heuristic match: "trvdp.com" Heuristic match: "target-video.com" Heuristic match: "kxlf.com" Heuristic match: "usemessages.com" Heuristic match: "dramaticdirection.com" Heuristic match: "yandex.fr" Heuristic match: "o\trust_tokens\trust_token_database_owner.cc" Heuristic match: "2477april2024.com" Heuristic match: "horonstogly.com" Heuristic match: "apps.pingone.com" Heuristic match: "dicebreaker.com" Heuristic match: "spectacularstamp.com" Heuristic match: "lherbstarsbuilding.com" Heuristic match: "nostalgicneed.com" Heuristic match: "firestormmarketing.com" Heuristic match: "dipvanish.com" Heuristic match: "appboycdn.com" Heuristic match: "8yuewen.com" Heuristic match: "newsleader.com" Heuristic match: "phx_ke@smct.io" Heuristic match: "intent.ly" Heuristic match: "youstarsbuilding.com" Heuristic match: "ctpost.com" Heuristic match: "nnowa.com" Heuristic match: "cdestinationamerica.com" Heuristic match: "topcomparativas.com" Heuristic match: "croomaingly.com" Heuristic match: "jan-magazine.nl" Heuristic match: "gintercom.io" Heuristic match: "w,tsmtp2go.net" Heuristic match: "49ers.com" Heuristic match: "wisepops.net" Heuristic match: "srootmetrics.com" Heuristic match: "n|kbredmart.com" Heuristic match: "yango.com" Heuristic match: "gpontiacdailyleader.com" Heuristic match: "paypal.lu" Heuristic match: "knitstamp.com" Heuristic match: "#changeablecats.com" Heuristic match: "msteadfastsound.com" Heuristic match: "burstdirectads.com" Heuristic match: "living-magazines.co.uk" Heuristic match: "#[rtoaster.jp" Heuristic match: "lowermybills.com" Heuristic match: "utarget.ru" Heuristic match: "ltelemundo40.com" Heuristic match: "dconnectad.io" Heuristic match: "aloodo.com" Heuristic match: "*ogury.com" Heuristic match: "?vmkt2178.com" Heuristic match: "cheqzone.com" Heuristic match: "lsony.co.id" Heuristic match: "a2ememain.be" Heuristic match: "b3mxnuvcer.com" Heuristic match: "v+yotpo.com" Heuristic match: "acsmedia.us" Heuristic match: "orb.ee" Heuristic match: "geniusmonkey.com" Heuristic match: "mkt6264.com" Heuristic match: "|lpwbd.com" Heuristic match: "allstarunion.com" Heuristic match: "zbgammaplatform.com" Heuristic match: "gammaplatform.com" Heuristic match: "seoptiks.com" Heuristic match: "bestofall.info" Heuristic match: "cnet.com" Heuristic match: "akstat.io" Heuristic match: "1tp88trk.com" Heuristic match: "jailbulb.com" Heuristic match: "papago-plus.com" Heuristic match: "vevor.de" Heuristic match: "vforroundprince.com" Heuristic match: "sie.com" Heuristic match: "warnerbrosgames.com" Heuristic match: "hospitablehat.com" Heuristic match: "ufoodie.com" Heuristic match: "powerstarsbuilding.com" Heuristic match: "ishumei.com" Heuristic match: "mkt10067.com" Heuristic match: "vccorp.vn" Heuristic match: "sonypictures.jp" Heuristic match: "omg.com" Heuristic match: "clarium.io" Heuristic match: "mydhli.com" Heuristic match: "6thedailyjournal.com" Heuristic match: "thetelegraph.com" Heuristic match: "bungeesleeves.com" Heuristic match: "createsend1.com" Heuristic match: "ksbw.com" Heuristic match: "rockerbox.com" Heuristic match: "stg.com" Heuristic match: "-pvouchercodes.co.uk" Heuristic match: "aliyun.com" Heuristic match: "shopifysvc.com" Heuristic match: "quotenet.nl" Heuristic match: "c88rx.com"5a:T4c1,file/memory contains long string with (Indicator: "--user-data-dir"; File: "msedgewebview2.exe") file/memory contains long string with (Indicator: "--user-data-dir"; Source: "00000000-00002160.00000000.305187.000E0000.00000004.mdmp, 00000000-00002160.00000002.309025.000E0000.00000004.mdmp, 00000000-00002160.00000003.309414.000E0000.00000004.mdmp") file/memory contains long string with (Indicator: "--user-data-dir"; Source: "00000000-00002160.00000000.305187.33800000.00000004.mdmp, 00000000-00002160.00000001.307105.33800000.00000004.mdmp, 00000000-00002160.00000002.309025.33800000.00000004.mdmp, 00000000-00002160.00000003.309414.33800000.00000004.mdmp") Found string "--user-data-dir=C:\Users\HA69nTn\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView" (Indicator: "--user-data-dir"; Source: "00000000-00002160.00000000.305187.33813000.00000004.mdmp, 00000000-00002160.00000001.307105.33813000.00000004.mdmp, 00000000-00002160.00000002.309025.33813000.00000004.mdmp, 00000000-00002160.00000003.309414.33813000.00000004.mdmp") file/memory contains long string with (Indicator: "--user-data-dir"; Source: "00000000-00004380.00000000.306340.EE200000.00000004.mdmp")5b:T805,Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "::GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "::WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtQueryInformationProcess incorrect size" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "::NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "::NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp")5c:Tc4c,Found string "base32heI9" (Indicator: "base32"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found string "base64ur" (Indicator: "base64"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found string "{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}" (Indicator: "aes"; File: "483c491c-cc61-4bd9-a4da-ccaba1cad878.tmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00002160.00000000.305187.0037C000.00000004.mdmp") Found string "fromBase64" (Indicator: "base64"; Source: "00000000-00002160.00000000.305187.01000000.00000004.mdmp") Found string "toBase64Q" (Indicator: "base64"; Source: "00000000-00002160.00000000.305187.01000000.00000004.mdmp") Found string "setFromBase64" (Indicator: "base64"; Source: "00000000-00002160.00000000.305187.01000000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") file/memory contains long string with (Indicator: "ecdsa"; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found string "AES-128 Key for Audible AAXC files" (Indicator: "aes"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found string "AES-128 IV for Audible AAXC files" (Indicator: "aes"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found string "Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)" (Indicator: "aes"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found string "AES for Intel AES-NI, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found string "AES-NI GCM module for x86_64, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found string "ChaCha20 for x86_64, CRYPTOGAMS by " (Indicator: "chacha"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found string "SymGetModuleBase64 FAILED" (Indicator: "base64"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found string "SymGetModuleBase64" (Indicator: "base64"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found string "CAESABiAgICA+P////8B" (Indicator: "aes"; Source: "00000000-00006372.00000000.304884.00004000.00000004.mdmp, 00000000-00006372.00000000.304884.00348000.00000004.mdmp, 00000000-00006372.00000001.306805.00004000.00000004.mdmp, 00000000-00006372.00000001.306805.00374000.00000004.mdmp, 00000000-00006372.00000002.308724.00004000.00000004.mdmp, 00000000-00006372.00000002.308724.00374000.00000004.mdmp, 00000000-00006372.00000003.309421.00004000.00000004.mdmp, 00000000-00006372.00000003.309421.00374000.00000004.mdmp") Found string "AESGCC20" (Indicator: "aes"; Source: "00000000-00006372.00000000.304884.00024000.00000004.mdmp, 00000000-00006372.00000001.306805.00024000.00000004.mdmp, 00000000-00006372.00000002.308724.00024000.00000004.mdmp, 00000000-00006372.00000003.309421.00024000.00000004.mdmp")5d:Td6b,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtQueryInformationProcess incorrect size" (Indicator: "QueryInformationProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "::NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "__vcrt_GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp")5e:Tc73,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "GetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetFileAttributesExFromAppW" (Indicator: "GetFileAttributes"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "AttemptToNotifyRunningChrome:GetCurrentDirectory failed" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetFileVersionInfo:" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "NtQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp")5f:T49e,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "K32GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "__vcrt_GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp")60:T1c9c,Found string "passwordsPrivate" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.0005C000.00000004.mdmp, 00000000-00002160.00000000.305187.00090000.00000004.mdmp, 00000000-00002160.00000000.305187.005AC000.00000004.mdmp, 00000000-00002160.00000000.305187.00614000.00000004.mdmp, 00000000-00002160.00000001.307105.0005C000.00000004.mdmp, 00000000-00002160.00000001.307105.00090000.00000004.mdmp, 00000000-00002160.00000001.307105.00614000.00000004.mdmp, 00000000-00002160.00000002.309025.00090000.00000004.mdmp, 00000000-00002160.00000002.309025.00614000.00000004.mdmp, 00000000-00002160.00000003.309414.0005C000.00000004.mdmp, 00000000-00002160.00000003.309414.00090000.00000004.mdmp, 00000000-00002160.00000003.309414.00614000.00000004.mdmp, 00000000-00002160.00000003.309414.00648000.00000004.mdmp") Found string "passwords" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.000E0000.00000004.mdmp, 00000000-00002160.00000000.305187.00414000.00000004.mdmp, 00000000-00002160.00000000.305187.00554000.00000004.mdmp, 00000000-00002160.00000001.307105.00554000.00000004.mdmp, 00000000-00002160.00000002.309025.000E0000.00000004.mdmp, 00000000-00002160.00000002.309025.00554000.00000004.mdmp, 00000000-00002160.00000003.309414.000E0000.00000004.mdmp, 00000000-00002160.00000003.309414.00554000.00000004.mdmp") Found string "password_manager" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.000E0000.00000004.mdmp, 00000000-00002160.00000000.305187.00414000.00000004.mdmp, 00000000-00002160.00000000.305187.00554000.00000004.mdmp, 00000000-00002160.00000001.307105.00554000.00000004.mdmp, 00000000-00002160.00000002.309025.000E0000.00000004.mdmp, 00000000-00002160.00000002.309025.00554000.00000004.mdmp, 00000000-00002160.00000003.309414.000E0000.00000004.mdmp, 00000000-00002160.00000003.309414.00554000.00000004.mdmp") Found string "edge://password-change/*" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.0014C000.00000004.mdmp, 00000000-00002160.00000000.305187.005C8000.00000004.mdmp, 00000000-00002160.00000002.309025.0014C000.00000004.mdmp, 00000000-00002160.00000002.309025.005C8000.00000004.mdmp, 00000000-00002160.00000003.309414.0014C000.00000004.mdmp, 00000000-00002160.00000003.309414.005C8000.00000004.mdmp") Found string "" autoComplete:"off" value:e.password onChange:s("password") disabled:n})]}) f.jsx("div",{className:"checker-actions",children:f.jsx("button",{type:"submit",className:"btn-primary",disabled:n,children:n?"Submitting request" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.00198000.00000004.mdmp, 00000000-00002160.00000000.305187.00A04000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00002160.00000000.305187.00198000.00000004.mdmp, 00000000-00002160.00000000.305187.00A04000.00000004.mdmp") Found string "-internal-password-container)" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.00258000.00000004.mdmp, 00000000-00002160.00000002.309025.00258000.00000004.mdmp") Found string "4password" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.002DC000.00000004.mdmp, 00000000-00002160.00000001.307105.002DC000.00000004.mdmp, 00000000-00002160.00000003.309414.002DC000.00000004.mdmp") Found string "password-reveal" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.002DC000.00000004.mdmp, 00000000-00002160.00000001.307105.002DC000.00000004.mdmp, 00000000-00002160.00000003.309414.002DC000.00000004.mdmp") Found string "reveal-password" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.002DC000.00000004.mdmp, 00000000-00002160.00000001.307105.002DC000.00000004.mdmp, 00000000-00002160.00000003.309414.002DC000.00000004.mdmp") Found string "password-manager" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.005AC000.00000004.mdmp, 00000000-00002160.00000001.307105.005DC000.00000004.mdmp") Found string "edge://password-manager/*" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.005C8000.00000004.mdmp, 00000000-00002160.00000002.309025.005C8000.00000004.mdmp, 00000000-00002160.00000003.309414.005C8000.00000004.mdmp") Found string "permission:passwordsPrivate" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.005C8000.00000004.mdmp, 00000000-00002160.00000002.309025.005C8000.00000004.mdmp, 00000000-00002160.00000003.309414.005C8000.00000004.mdmp") Found string "password-change" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.00604000.00000004.mdmp, 00000000-00002160.00000001.307105.005DC000.00000004.mdmp, 00000000-00002160.00000001.307105.00604000.00000004.mdmp, 00000000-00002160.00000003.309414.0057C000.00000004.mdmp, 00000000-00002160.00000003.309414.00604000.00000004.mdmp") Found string "passwordU" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.01000000.00000004.mdmp") Found string "your password stays on your deviceAdding to Microsoft Edge" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found string "=1 {1 password is saved only to this device. To use it on your other devices, save it in your Google Account. This will also clean up any duplicates.}" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found string "other {{PASSWORD_COUNT} passwords are saved only to this device. To use them on your other devices, save them in your Google Account. This will also clean up any duplicates.}" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found string "=1 {1 password and other items are saved only to this device. To use them on your other devices, save them in your Google Account. This will also clean up any duplicates.}" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found string "other {{PASSWORD_COUNT} passwords and other items are saved only to this device. To use them on your other devices, save them in your Google Account. This will also clean up any duplicates.}" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found string "=1 {1 password is saved only to this device. To use it on your other devices, save it in your Google Account.}" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found string "other {{PASSWORD_COUNT} passwords are saved only to this device. To use them on your other devices, save them in your Google Account.}" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found string "=1 {1 password and other items are saved only to this device. To use them on your other devices, save them in your Google Account.}" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp") Found string "other {{PASSWORD_COUNT} passwords and other items are saved only to this device. To use them on your other devices, save them in your Google Account.}" (Indicator: "password"; Source: "00000000-00002160.00000000.305187.351A0000.00000002.mdmp")61:T924,Found string "\Device\HarddiskVolume3\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Indicator: "\Device\"; Source: "00000000-00007816-00000BC0-3419665080") Found string "\Device\HarddiskVolume3\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedge_elf.dll" (Indicator: "\Device\"; Source: "00000000-00002160.00000000.305187.33800000.00000004.mdmp, 00000000-00002160.00000001.307105.33800000.00000004.mdmp, 00000000-00002160.00000002.309025.33800000.00000004.mdmp, 00000000-00002160.00000003.309414.33800000.00000004.mdmp") Found string "\Device\DeviceApi" (Indicator: "\Device\"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found string "\Device\KsecDD" (Indicator: "\Device\"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found string "\Device\HarddiskVolume3\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedge_elf.dll" (Indicator: "\Device\"; Source: "00000000-00004380.00000000.306340.EE200000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00006372.00000000.304884.00024000.00000004.mdmp, 00000000-00006372.00000001.306805.00024000.00000004.mdmp, 00000000-00006372.00000002.308724.00024000.00000004.mdmp, 00000000-00006372.00000003.309421.00024000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00006372.00000000.304884.00024000.00000004.mdmp, 00000000-00006372.00000001.306805.00024000.00000004.mdmp, 00000000-00006372.00000002.308724.00024000.00000004.mdmp, 00000000-00006372.00000003.309421.00024000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\etc" (Indicator: "\drivers\"; Source: "00000000-00006372.00000000.304884.00024000.00000004.mdmp, 00000000-00006372.00000001.306805.00024000.00000004.mdmp, 00000000-00006372.00000002.308724.00024000.00000004.mdmp, 00000000-00006372.00000003.309421.00024000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\etc" (Indicator: "system32\drivers"; Source: "00000000-00006372.00000000.304884.00024000.00000004.mdmp, 00000000-00006372.00000001.306805.00024000.00000004.mdmp, 00000000-00006372.00000002.308724.00024000.00000004.mdmp, 00000000-00006372.00000003.309421.00024000.00000004.mdmp")62:T58c,Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy failed with Policy:" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp")63:Tf5c,Found reference to API "CheckTokenCapability" (Indicator: "CheckTokenCapability"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "AccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "AddMandatoryAce" (Indicator: "AddMandatoryAce"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "CreateRestrictedToken" (Indicator: "CreateRestrictedToken"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "MapGenericMask" (Indicator: "MapGenericMask"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp")64:T454,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002544.00000000.305966.6C58D000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp")65:Tcde,"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")66:T50a3,"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "A61900000000000004000400010019020200000000B31C020152B6010212F80002388F020285C70102E8C20103A63A0203CBE40103F91B02043E8E02045F9A0204931A0104AF630104DADC0105DE850205F9E70106C42802079A1902088D4201089E1902095E2F0209A336010A6B6C010BE8C5010BF99C020C3131020CE9C2000D28C7010D7879000D7E3E020D7E4F020DD3F9000E091A020E303E020E9F67020F168C01101755021043E800104C8E02112969021142C20011AB3D0212E5F800130A360213951B0213E9780014FD160215E07E0216D134021793380117C06F0117DE370118208A02186C1E0219C0E2001A2D42021AE8EC011BF60B001C955C001D3083021D3BC5011D5819021E451E021EC330021ED770011F34CC011F626C021F6C76022018F200213AC30121777A00223BED0122A7730123116E01237AF80123ABE90123CC4F01246B460124ACC70024C18B0125023802254F6E01262B9401264BA801267F9D022834190228A11B012919DA0129450101297DA90129861F0229CE33022AC7DE002B2499002BD8E5012C9F7A022CA603022D22DA012D5838012E1EF0012E4A1C022E6974012E7714022F39D5002F4CE5012FA8FF0131484F003257A400329F7A0232D1A70032D45F0133FB2A0233FE38023542CC0135602102361EE10139A7C20139AFDE013A99D9013B8031023CB352003D121F023D218F023DC47F023E1CB7013E3383003E5BED01403D670140A28E0141A8760041BC3A02420D510242264A0042B3AE0042C54D02435EBA0143AB210144A4C401454ED30045668A024677300146AB2E02483BDB0148C24F0048F9A60049CBA30149DA1B0249EAB7004AAA81004AC433024ADEE1014B2A91014B6EE3014B7207024BF474024C15AA014C41B4004C9E02024CC84B014D3ED9014E50C2014F14C2004FA53302508F00025276930253467301536A3A02538AAD015408340254302F0254B7DC0054DFE20155DB8C0155E6E101560A850057426B01577AF801578A1B0257AD120158021202589E270258BB5C025953940059C43C025A0189025A0289025A0A83025A2C80015AE213025AF783025B1203025C3598015E83D7015EF05F025F83500261D42A0261D98C0162DC300262EF34026396770063EC740263FD310264054E0264C9260164D4190164F42B0265C4850265ED1D0267ABEE0167BA6B0268130102682C90006957EA0169592A0269CC4F016A3683026A61E8016A7365016A95E2016BF42B026C0B76026C137F026C6F66026D2390026DEE2C026E4538027052E20170A32C0271014902718C9A02726E4A0072A2420172CD990173422F0274A3A30175A37E007691CF0177D52F0277F98F0178159600785DD30179F99C027A5B7C027C82C9017CBAFC017D904A017DBBD6017E1044017E3732027E5030027EEE89027F16AA017F88CA00800184028106950081B0690281B942028227730082409702825B8A0282FB2A02833AC50183F16000844D260184D7780284E11E0284E6830085311B028550AE0085E34102861BDE01867B060186ECB6018754990287D5140287DE830087F0250187FC38028881870288D13302890CE901892F830289DC8B018A8093008AFAE3008BEEF2008BFD6E018C1D88028C8F94028E78A2008E90C6018ED891018FEAF9019123D30091C335029259160092603302928271009369C70093CA3D0293CDFD0193CE8C019439F701945AE001945B270294A15B0195126E01959F33019697E30196A26E0197F6C40098C7F10198D7780299429B02996776029A0B73019B4A72029C429B029C4D22029CE0A8009D9D92009E1E90019F8230029F8314029FF47702A1236602A19D2A01A2050600A2065D02A2961002A3998D02A3C4E200A3C88302A3E8DD01A4580200A4778D02A4AEE901A5092E02A5ADCF00A644A600A6E9B300A736A800A7B8AD00A7C23301A7E23E02A8EA4E02AAB1FC01AAF63F02AB9FC901ABF42B02AC4D1C02AC54F900AC79D901AC930202AD2DB801AD73BF00AE4D5702AEE69101AF086501AF9C0202B09E9702B0F13802B2376E01B2827902B2BAFC01B3732002B3742D02B392FB00B4D7C501B51B6701B5661202B7750C02B7E23E02B8C37F02B91AF300B9B92A02B9FA7702BB51DD01BB8E1602BB8E8B00BBF42B02BC6EB400BCD22A01BD388F00BEAF8A02BF674602BFDC4602C0079A00C03A8E02C046AD00C1BCF101C2151602C2610B01C2DEE401C2FD7C02C33EA300C36D8100C399F300C535C900C561EA01C58D9002C5EA1602C6331902C75DD700C85C5902C8B83902C9389700CA072E02CA23B700CB533302CB74DA00CC495600CCEFEF00CDBA8302CE99E001CEE23E02CF1C0402CF74AA00CFF36501D0175600D0B00802D1D2A700D2C12702D2CF9D02D2E67302D2ED3702D3140C02D3826100D3834B01D3E88D00D4489A01D4A04002D5398801D5F78602D6231F02D6EF5802D737C501D7D2C501D7E86C02D8E79C01D940E901D997E001DA0B7301DA38C801DB7A1402DB87DD01DBE23E02DBE56F02DC451502DC5C2B02DD1B1901DE0F8702DE692702DF294302E0093602E01FA101E0BC0102E1417E02E16D9901E17E8C00E193B001E1E3D801E21B5600E2BC8802E2DB2C02E4402701E469C900E4EF1B02E5BD5C01E5E03902E6109902E63E2B0DE66C8100E6BD3902E7A3E901E7A4D900E7E23E02E88E2401E98C0A01E9D36601E9EA3402EB3B9402EB8D3302EB908D02EC63C501EC95E101ECBC3602EDAA2E02EE165502EE5F9902EE930202EEAF9B02EFD67202F0694F02F07F0B02F0B91402F0E0B600F133E901F13A9102F1728102F17D5F00F1AD3D01F1FC6000F20E9302F2B4FA00F2FFA501F308DB00F3492A02F3658E02F3894001F3B82102F458EC01F4EA9502F5500D01F577C201F62D3102F6F12B02F7125E00F7D36F00F7EC8302F7ED6A00F8C13D02F9DFA101FA667802FAFB8402FB8CC601FC3A4701FC75BA01FD148602FDB0D900FDDFE501FE784F02FE8D5E02FEDC8C01FEE26301FF10DD01FF3400023900060000000DEAFC0110BE880212F7C70113F7C7011A6F93021BA02E02212E4D0225C5010228614B022E240F022EDD89023C6AF901410189024BFC6D0251B2340261057C0261367A0263CB2E0269B992026A23E20170FC8802786C6D0279DE98027E018902877B32028B2894028EE3780299345802996776029E306B02A1866302A6749502AFA32E02B0D58102B5235202B6F13B02B7F15002BB635C02C1239D01C3445D02C8D15D02CF6C8502CFF42B02D88C3F02DBB95D02DCEF8E02DFD47602E2077F02E4718902EA5B9402EBAC7502EDF38E02EF007702F02A7402F0E23E02F7CC9002FC998D020600400100001ED770014B11B4006041AE00682C9000A5ADCF00CE99E0010100420100009E1E9001010043010000C0EC7C0000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT\EXTENSIONS.SETTINGS"; Key: "DGIKLKFKLLIKCANFONKCABMBDFMGLEAG"; Value: "E7450E8084CA4B1DE283B483FA08DCCDE5751C3037148CDDE099AC183CB23E92") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT\EXTENSIONS.SETTINGS"; Key: "MHJFBMDGCFJBBPAEOJOFOHOEFGIEHJAI"; Value: "4BB829A8146F56C794636EEE3B9DE7051E8B7FAD4D3B26641B0366CA71A6DB1F") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SCHEDULE_TO_FLUSH_TO_DISK"; Value: "CC04B864F8FBB14C30F4EDCDDCB107ACED34B22F6DDAE60C75C056B8A961E36E") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\BLBEACON"; Key: "FAILED_COUNT"; Value: "0000000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\BLBEACON"; Key: "STATE"; Value: "0200000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\THIRDPARTY"; Key: "STATUSCODES"; Value: "") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\THIRDPARTY"; Key: "STATUSCODES"; Value: "0100000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\BLBEACON"; Key: "STATE"; Value: "0100000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"; Key: "DR"; Value: "3100000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\STABILITYMETRICS"; Key: "USER_EXPERIENCE_METRICS.STABILITY.EXITED_CLEANLY"; Value: "0000000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW"; Key: "USAGESTATSINSAMPLE"; Value: "0100000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "EXTENSIONS.INSTALL.INITIALPROVIDERNAME"; Value: "8F1C6041B8628112957911BF70E82A3BDEBE59E5B94E600D3D220383823BC1D9") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SCHEDULE_TO_FLUSH_TO_DISK"; Value: "19FB986B973152C03BFF5F22AC1E26FBAD9888A03291563479627F544CA94F74") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "EXTENSIONS.UI.DEVELOPER_MODE"; Value: "26893109DE21A352A2B4E8F7F1AC798988E6AE9C756329FDC8A4BF5387261AC1") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "GOOGLE.SERVICES.LAST_SIGNED_IN_USERNAME"; Value: "69079CF297AC7955D4075F18F35AFFABEAED866DEB1D7092E81D850BF7FBF8AE") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "MEDIA.CDM.ORIGIN_DATA"; Value: "81046E921B34925EF9312C9A62CC5AFFB0D63E7CA2C13AC486278B291F7C08F2") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "MEDIA.STORAGE_ID_SALT"; Value: "18C0B52B135CAAFE1A26692ACA1C9982741B19572B524EDC4374A776E1410749") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "EDGE.SERVICES.ACCOUNT_ID"; Value: "FD5FDCB0CAABEDAB8ADBFB8CAE49EFEB86D67C19905F86EA40BE155EA4CF95C3") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "EDGE.SERVICES.LAST_USERNAME"; Value: "F1D14C0303D45F3F1897EDC54641E381DCFCC0F4DA8AB5729CB2BD090C7E5D29") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "DEFAULT_SEARCH_PROVIDER_DATA.TEMPLATE_URL_DATA"; Value: "8BAF22244C810B6D25BE595D1F42EC353FF7C8FBD9C37513B47A2FFA8AF4E0E3") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SAFEBROWSING.INCIDENTS_SENT"; Value: "EA671475338AD6FE402471D7D8D4EF1281F73757AA24A90655F4D914CBE849AC") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "PINNED_TABS"; Value: "B2BF049BBA813039124A63BB29E947E9C847BE52658FFCA0481EC03DBAD455C4") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "EXTENSIONS.INSTALL.INITIALLIST"; Value: "9976A8B7F0309E616ABED4BA16F0E305D4324370D500493B99E7DA1D16063C66") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SEARCH_PROVIDER_OVERRIDES"; Value: "05F935AA9AD5A85C92799FF621F7A2A3F3AFB85EE0BCC32E215F5BB74CDE2DAA") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SESSION.STARTUP_URLS"; Value: "24745F213395D77E2CAF29CDF5FFD8E20FB835E8842E67462CBEFD3BE1BE8914") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "SESSION.RESTORE_ON_STARTUP"; Value: "0C2485E85D9BD72F0A0CCF33FF52FF3E53A61AE2C7EEEE5A836EFF40285E79ED") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "PREFS.PREFERENCE_RESET_TIME"; Value: "D1453E7B6E0C205D73D8D87653914AE80D4D581F6C41F1B183F4EF42C70BDAA7") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "BROWSER.SHOW_HOME_BUTTON"; Value: "47B54312B5CB65CE9F9BAB1285F556066FC209F95976E493E414072167406768") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "HOMEPAGE"; Value: "6224108CC3CA531C5AB214984B64A07566F31FED35B7EA78AF79506FE24C70D9") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "ENTERPRISE_SIGNIN.POLICY_RECOVERY_TOKEN"; Value: "FD7BB82476D6D2E921206452A4D3B4CC01C76FB24B3AA76B8CDCBDC74FA69206") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\PREFERENCEMACS\DEFAULT"; Key: "HOMEPAGE_IS_NEWTABPAGE"; Value: "3E57B3E255EA4EEEF742240A3B2D03B8E9FB8F118D889079A164E0EA23345F59") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEUPDATE\CLIENTSTATE\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"; Key: "LASTRUN"; Value: "13436587380049077") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\EDGEWEBVIEW\BLBEACON"; Key: "VERSION"; Value: "144.0.3719.115") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATEMEDIUM\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"; Key: "USAGESTATS"; Value: "0000000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\EDGEUPDATE\CLIENTSTATEMEDIUM\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"; Key: "URLSTATS"; Value: "0000000000") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\PROPERTY"; Key: "0018C01834ECED7F"; Value: "0100000001000000D08C9DDF0115D1118C7A00C04FC297EB01000000B37752CA87E7E04E8581DD349BFAC6DF00000000020000000000106600000001000020000000FDA94169934DD73DDFFEE9DBD1288F3448F9D8D5DE8B7374CFE6D875F3BCB11B000000000E8000000002000020000000B6CF1777C704BBB83CF38463751F39B9CA9F62FD48F06CB9C51E7EE9C501C8F1800000000C99315B93AF48E725BB3DB0692B57CEF8FCC2D82D9275CADE5F331420898E06F4A80D348EEBC1E16D72BFEE1CAF3F8ECFD8428C8EB944753D2C642E2EC8331E0B733152C60EB51FD742FEC6A447ADE31AC517D1D993583FC86F4935F3A86B44706D8B38A43209FA6C391B9C0FA52F7FE0126816733110123B61F73A6E41A5DD4000000057C3BFE0414CB97437F51437A4BD65644462668C82D59010FE0182F7781D800E43512A4859A074B9DDCA3B3E65A90A7E92D93460F852A805243912CD17FB128F00") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{67082621-8D18-4333-9C64-10DE93676363}"; Key: "DEVICETICKET"; Value: "0100000001000000D08C9DDF0115D1118C7A00C04FC297EB01000000B37752CA87E7E04E8581DD349BFAC6DF00000000020000000000106600000001000020000000C49E3D6B2B24E35EE08BF6ADD9D9212C3DCB46E749592655CFCC4E0D977E9D02000000000E800000000200002000000001C93D190EB2A8A2CE1D62F067BF226B0E669F7FB19C8C893FBF3DC6158291ECC00C00007139335D18AB1AD41E418BB893DCF688D07434F9E664D2A696AB4544482B197D3247EB62ACC4FEE2095427ED9F2D0B1ACE39A77861E5A8B1C98481A888E4877016AC3408F07AC1BDFFDA396BE9A164AAFAD42EA2B9924C8AB5E3B97BA2A21A2BA2711C40E1DF4C9D534702583DA8F3BB26A4C2EC43EA0DA71B68E1AFABB01FF3AB08F36F3BC1552904E6FF4F7605744EC1E6A1A7696B371091117198BECD1D97ED4D740976D10C04B59231F83901819BC7F20AAE6B6D20053322E16380AD9D6F9A242FF6E7558ADA9E03FEBDED736005702D2F49FBB63EBEE501E21ECDD37ED121A59646C7E92CAF942B98FCEED309DB288B70EB7162B7A903B02E9E8D9923EE1446D42EDEF5C31373020833865B4BF8A06530FD3D371C719F77671642CB990ADB636D6BC384AE4EA53E46F13E510C422C2F792FF8C7474AEBD2528450360CDDAE02FBC69D71622BC795FD3038A702700F387AF5A3AF4C92365D2D9F87F45926086471F21108318B45941B50223477168D69B3D7F6B1E0C04C6C85FA6958E8F08AFE9235C7B1D5CFFCAAB8B0691410B988FC6D6795F99BE93C3105778D6C66B243A25F70D9386C22BA5FAFF463A56C6FDA69B4BCD35D0B7178384DFAA40F8FC98FF146AD60440E9FB1C9859A26E8ED00D6B25FF41712A2621E8EF1FDD2A71A4B10CF2CD84842CBC974F42F99429A10B5F223E42897A603BEAA25AD5A2B2F1E1405FDBFC031835FBA500A74D510F7DE65947E648ABA471D6CD58D23AB921565E78572FBE1DBBF4E820F6998D3AC32CA7F19FAA234980F9E01D0EE08B32F97475ACD2FE47437B237BCF9B1F30042778D2952B351B40B85A06D9D0DC50F183A2B0EA199A56C685646DF988536DAC041614DCA0378E1ABD30E380002CCAFF4E3A725C402E2CA232D497D320FC502B581FB72859DC2F12C73793223F3ADC28761093C752AA853A5EF49933ACFA7609592D515C1EDB8FD7DB6729B174929B21B63CDD1160A03C76CC0C32DDBBF8DA08036358A83BE70241F492353C342230A151801E49F51798ED9CCC789E8D48C81E714FB5F1482D6F4F49948AF1E965CB0EA4A8FA143F384A6F9349E4A861AE87F5DB44978EF4133C9A5A3B7E99544E424F92446FF28E6B2303E46E203EB85144893DA7AF3B373A486A5B8BDA2C1F2A57138DF30586343626FDFF07517376C89F4F2FE8F4D53D62C59CD991109661B9DEA92FD22901D423B9FA2D219AE71E7F574E44D6C37C7CA64285D7AD42E41605271D1F3631A8007874346CA94A218A6DDFAB52689C3BA684C24A8DE866AFBBE9FA184743C603D54DE61F407B4CFE5CFC3F858959E9C59F259AB64900EA50C98C53AA3CEA4A9768612470CAF3B13F663BA11BCBF0B2EC32CEF067B954E05B91D8C02A572D63F2FF2704B1ADFB8816F275089E0A4782E983088FDD1C011EC7EE88F4EA91A524DF4AE73FB48A500AA76E375A5D8BF0D57BF3471D44C74DAF9D1F48799AEA65A7305D9C93C7CD48D5D03083EB14D6C7F70E1FFEA8E2CB0D0A0BD8AA415BA72059955C3EEB9B83F705243207488AC3CEFAC2B3400A430A9F6B60C1091BFA5F44B3A0B47E135A0007432FA76FDB72F3AE55C71B3980B8A2447658E54AE82C1803E5C36CB5E1F7B81AE18F28B74C3289212223A6A885DF66456A1A0B5DF669B1741D29627D7B0F972D8AED8EEBDCEF0945AB1157E7C5A964605FD36B26DC58DC5A1BF5BCE17AE3F3E888E5D32362F51A697AD26588487513BC31BCE56AB17A0EFDA2DE14D86CFEEA7AE34C5914F3EC9F2AD4B4177E3C44B4333677D4A5FC3EA00AD78E50BBE35B79502FFEA66003C1D653F46AED9A6BE3F0E8B8CDAA7D5DB6F4775D0A9804B189CA3D59C9375B5867906B9DB376C8EA0D6D593D269E21133A7D8C94E5CA759B4748022BB5B16C51E2A65330D16621D9B55A00277338B7E187F466B696C4B5357D44159A065E17C8BDBAC8122F979CF8C4B43776693765689382B3C309320BA01CEEB28B38D9AC41567C88327B07AF6530B8A17C0204B1ECEDC211BBDB25F89E8F7BFAD11FAA4B4CE4BA88053CBD05240B134F1926195A7E01E062D1B8C561132A5637B0B3D8952466AC3714050DBFC4BA9A573F51B88F66B949568B20984FD499224F1FB89F4A294D0B6FB2CA2AD2D6156FB0610971B32C159D613617F9AB755CF52DC187B07049ACE056B5C298316EF89940533FBE4BD2D9F9E04F8462F763AE66632A82543AB53647F5229D27767E4B328AB87DC27DB93FD379F4AEE872A49964F83FFCCC42AB42D36EBC48B7AF2A2AB20378F3E10A079ED1DF4C42EF500035B1A7A8875C2FA999FC0552C5ACDCFA7A82B4E30B21395B4138680C8076E92E74DA84D14EAECCB5A0AF48544838E7E6AE8C5BE2E545ADAFAE1273D50DD8CD72DBF1190BF5FD2F71B9C7958003A43B1E48BD267C609393AEB9A8559042F02417BD231E9A394083CBF7D7D7B9FBCC2AAACE65C63D3126382EC140D01C3DCCEDA5A736E33D521A41209CE5B42F45A147959484B4138D3AB74CD98A046F988D693D018C9C4D4C76840B220369E189EAA6B3F6D335C2B8CA2C7FB75025716AB94DF2CDBF46B4D87385E15294D6F113085F6D644D12DE7AF936326E7EB8676A3056C54B4D223A59944D39AB057F2F3D777BFD7C13939F91829509EDB1E6AC9F070671219C1EB32FA73ED5F562D33F575AB3A93F5D9B9D23CE693F3AA85B4B5BF0F8BCB388B29A9C3597B3286E2EF5C6AC4054E74537F10A5CCC6698C96AC09C3D9A570F525ACB03DBF577F63A0C799429C2217303524BC31B2B22AAB74F2EDB0E08D19B312D32ED5BCFC077FC6EF9AA225EEF04D3C6E70DEB78E33FC2164892EACFABDA567B43B445E1DD033ED8CB3A741CB37C6AE2A3933FFF728028D8B8F370DA63972FCA620A64AA7EB4BF2BE3EAD12C44BF6FF9798BC87AE393DD8285D8B8AA8290770E0AA8B791DA133BEF80016AC0C0C5236A1BFA6FC04CC909DAD3941D3F3BA3500AD53C2312B398A0C90B979F0329C6A522C618DEA5895DAEF90E24872E4973D6D7013671E613C265D58BFEF9C897E1C614843E0B76E1E0DBB0CDB4DB8C4BD74538DC05400139FFABF522F160D193FE81075A0B050E3FE18167B96DCA3522F3B8B762D6309687BC3AFF6122DFABC5F15F101232BB33754AA9298CBD9A5F7F7ED4EC05C0DEBE0EDB2AAD88C94EC20B8C8141AB231754EBAB5B2943973F0CE7FE1A22FF8528FB977C9738C00291E5B936DE418F468DEA4D71730B86D7AAD0A56917605321CB79F3068BC1139E9DA3AE7194395FF5E272955423F7AB6A76B4C2124DD4A6AE0B250C24F60215F6C191827ABEF1F40A32FA22A62643DA4E345346AD7A6CD87F83BB60DC16BADEAA0804B0E19C6E65702F1420DA10FF9422FA3BE7ACF0EF82C1C3150185B4DB0189A77259FB95D6B987C5FED0BE9318E4AC44E2DE3621928A73CC17DDC10F84A1F9772563CD944825D37A7FC8ACDEE2DCD8E735587DDCC1EE5D0763631CF53E2E0E4FE6D3FAF794CC433A1A23B44D9D127819D4B83CBD64724DDB3E1E5D24277B1190342A32BCBA637F533EAD28D30D62AAF8AE4A860E8B6928A5B819156A0658E386DF41805F0801594D3565D1AD66E48BD9DDDBF3DE67E37AC6A08BE1777AF63C85C281371D762E81C0D58825BC458D234B30C4068C5CC51B44DE7300DAB381A71B9654914007835E2B3FC0D9444333AD7528106531EC60D9E415AFC57F0C30B89DFC8899DAA462D806B266C412D46B7FE6730CE6CF0C822D7FBE9745CEDA96AA4059FAD27CA70E81657625D47FA34D4401BD364380E6C2E7277841A979F11E0B213F44E05264B442AF97C7D27385C0DC46F6C104609FD188817230F2E4FBCD327DC3220E9CE2B4B0E0856807432E5CD0F055670ED0195E09CC19A402ED9F50D46863C46AD3907DF00C45887FD4D40C0969EAF3A66EF1070FB1509D25051DFF9B1B077258206B9BA089A4E8F270CF1659F56AB9B8A6F8971989625ED7CB3A88204BA2C33131EAA95EFF98B0D14326F085DC09D6A6ED54313CA2ABC7095E2722F31E61C751FFD5DCAA5087DE221010A388659BD757D4EAC1E16E7434B0B5F62E3837EDA5A8A8E76303C236F12A525D13D93C2549F0E0333B1B95D7C64DBE4FD24E41894D45C6775AC714C0F600D991259C43F26DF6640FF2E296E63BF54F709CDBC29ACD3F3B1A4F20AFE58D79AE110D9CDC60C00D0DBB3C9B4C3B86425A145D380C55F3432BF86051969D81D286C0A4C40465836309FA8B9DDAF7D1A0FB1B7486B541DB1F395AF00B877E75968FD48834DF584FDF83D887E34B245CD5AD23CFB442533FF9AC00FFF1B39E0823377A69BF807D38E1958CE0654C3E15A4FFC4CAE007ECD45D6BABD7750F4F742F219F9D696642CF2831A16AF739632F3B7582870FA582327ACB7E5E848AC26998CC559A975707B96FA62F44949F02CF18CAA6835DC54C4D94C03D2719A6029FF67C1B1E0F75D8179E9C24341FB8A98A8499033788A1BEA5B7431E3EBCD93169F2E42B7A2F90A99D1B961098C11E3C24347515EE5FCEFFA39DAD49DB6F1A944BAA923502A7535762453061EC415450CED27DF0D67D64126B3871D6D1D6208AA805138559A4000000085CE91E4925DAA23FFC3FE73E953B50FFF6696A75FA431A4B6430D84B9EF6CE4C0999F23574D982745A1B943B2274434673F66E3AAD06E9F96A9A04D4A3B6A8300") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{67082621-8D18-4333-9C64-10DE93676363}"; Key: "DEVICEID"; Value: "0018C01834ECED7F") "msedgewebview2.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{67082621-8D18-4333-9C64-10DE93676363}"; Key: "APPLICATIONFLAGS"; Value: "0100000000")67:T1400,Dropped file: "0b50d14e-6713-41f2-9197-30ff6ff07a80.dmp" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Crashpad\reports\0b50d14e-6713-41f2-9197-30ff6ff07a80.dmp]- [targetUID: 00000000-00007364] Dropped file: "data_1" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\GPUCache\data_1]- [targetUID: 00000000-00006572] Dropped file: "index" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\DawnWebGPUCache\index]- [targetUID: 00000000-00006372] Dropped file: "index" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\DawnGraphiteCache\index]- [targetUID: 00000000-00006372] Dropped file: "index" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\GPUCache\index]- [targetUID: 00000000-00006372] Dropped file: "index" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\index]- [targetUID: 00000000-00006372] Dropped file: "Web Data" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Web Data]- [targetUID: 00000000-00006572] Dropped file: "History" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\History]- [targetUID: 00000000-00006572] Dropped file: "db" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Shared Dictionary\db]- [targetUID: 00000000-00006372] Dropped file: "Login Data" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Login Data]- [targetUID: 00000000-00006572] Dropped file: "Trust Tokens" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\Trust Tokens]- [targetUID: 00000000-00006372] Dropped file: "Reporting and NEL" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Network\Reporting and NEL]- [targetUID: 00000000-00006372] Dropped file: "Vpn Tokens" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Vpn Tokens]- [targetUID: 00000000-00006572] Dropped file: "Safe Browsing Cookies" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies]- [targetUID: 00000000-00006372] Dropped file: "ServerCertificate" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\ServerCertificate]- [targetUID: 00000000-00006572] Dropped file: "Favicons" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Favicons]- [targetUID: 00000000-00006572] Dropped file: "88530ea3-1d84-4492-86a8-4bd30e6eebc4.tmp" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\88530ea3-1d84-4492-86a8-4bd30e6eebc4.tmp]- [targetUID: 00000000-00006572] Dropped file: "data_2" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\data_2]- [targetUID: 00000000-00006572] Dropped file: "data_0" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\DawnGraphiteCache\data_0]- [targetUID: 00000000-00006572] Dropped file: "data_3" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\DawnGraphiteCache\data_3]- [targetUID: 00000000-00006572] Dropped file: "e3ebe5a9-8d85-498d-a904-39eb1d2ef440.tmp" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\e3ebe5a9-8d85-498d-a904-39eb1d2ef440.tmp]- [targetUID: 00000000-00006572] Dropped file: "2c9bf446-8dab-4854-ae9f-7e4c49574432.tmp" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\2c9bf446-8dab-4854-ae9f-7e4c49574432.tmp]- [targetUID: 00000000-00006572] Dropped file: "Edge-Local-State-Tmp-adafb66e-97fc-46ec-bc9e-befcace80994.tmp" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-adafb66e-97fc-46ec-bc9e-befcace80994.tmp]- [targetUID: 00000000-00006572] Dropped file: "SharedStorage" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\SharedStorage]- [targetUID: 00000000-00006572] Dropped file: "Edge-Local-State-Tmp-369a3029-f5b9-4c81-8c01-7f9f0918b57a.tmp" - Location: [%APPDATA%\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-369a3029-f5b9-4c81-8c01-7f9f0918b57a.tmp]- [targetUID: 00000000-00006572]68:Ta9e,"msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"} "msedgewebview2.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"} "msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "cbBinary": "20" "dwFlags": "1073741836" "pszString": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "pcchString": "28000000"} "msedgewebview2.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "cbBinary": "20" "dwFlags": "1073741836" "pszString": "e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408" "pcchString": "28000000"} "msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"} "msedgewebview2.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"} "msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "cbBinary": "20" "dwFlags": "1073741836" "pszString": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "pcchString": "28000000"} "msedgewebview2.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "cbBinary": "20" "dwFlags": "1073741836" "pszString": "8ae9f0c30ea1668425d0f7d6255d597ead710776" "pcchString": "28000000"} "msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "Z*pX" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"} "msedgewebview2.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "Z*pX" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"} "msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "Z*pX" "cbBinary": "20" "dwFlags": "1073741836" "pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "pcchString": "28000000"} "msedgewebview2.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "Z*pX" "cbBinary": "20" "dwFlags": "1073741836" "pszString": "5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b" "pcchString": "28000000"} "msedgewebview2.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "ab1e781e118b61049965e4363c6d9de47fbed751" "cbBinary": "20" "dwFlags": "1073741836" "pcchString": "29000000"}69:T405,"other {Some of these files are encrypted. Ask their owner to decrypt.}}Your administrator says: "$1"$1 has sensitive or dangerous data. Your administrator says: "$2"Discard filePlease enter a reason for uploading this data:Please enter a reason for pasting this data:Please enter a reason for printing this data:Please enter a reason for downloading this data:Save to cloud storageThis file has sensitive or dangerous data. Your organization will let you save it to cloud storage or discard itData SharingGet more protection against dangerous websites and downloadsClose tipEnhanced Safe Browsing is offYou have Microsoft Edge's strongest security against dangerous websites, downloads and extensionsYou're getting standard security protection. To get more protection against dangerous websites, downloads, and extensions, turn on Enhanced Safe Browsing in Microsoft Edge settings.Microsoft Edge settings{NUM_SUB_APPS, plural," (Source: 00000000-00002160.00000000.305187.351A0000.00000002.mdmp, Indicator: "files are encrypted")6a:T9ed,"msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\BrowserMetrics\BrowserMetrics-6AD17A94-19AC.pma" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\BrowserMetrics-spare.pma" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Local State" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-eccaa385-d549-424a-8f96-148c3e2a2bbf.tmp" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\index" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\data_0" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\data_1" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\data_2" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\ShaderCache\data_3" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Edge-Local-State-Tmp-76b2d190-3d46-44f3-8d93-867ffcceb31c.tmp" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Local State~RF489c9f.TMP" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index" with delete access "msedgewebview2.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index" with delete access6b:T862,"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" wrote 000011C0 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 980) "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 980) "msedgewebview2.exe" wrote 000011C0 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 532) "msedgewebview2.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 532) "msedgewebview2.exe" wrote 000011C0 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 2016) "msedgewebview2.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 2016) "msedgewebview2.exe" wrote 00000170 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 2016) "msedgewebview2.exe" wrote 0000002C bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 2016) "msedgewebview2.exe" wrote 00000010 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 2016) "msedgewebview2.exe" wrote 00000020 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 2016) "msedgewebview2.exe" wrote 000000E8 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 2016) "msedgewebview2.exe" wrote 00000100 bytes to a remote process "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\144.0.3719.115\msedgewebview2.exe" (Handle: 2016)6c:T751,"msedgewebview2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\APPDATA\APPID=ECD6B820-32C2-49B6-98A6-444530E5A77A&CLIENTID=ECD6B820-32C2-49B6-98A6-444530E5A77A") "msedgewebview2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\APPDATA\APPID=ECD6B820-32C2-49B6-98A6-444530E5A77A&CLIENTID=ECD6B820-32C2-49B6-98A6-444530E5A77A"; Key: "FIRSTPARTY") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL"; Key: "LOGINURL") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL"; Key: "SERVICEENVIRONMENT") "msedgewebview2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{67082621-8D18-4333-9C64-10DE93676363}") "msedgewebview2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{67082621-8D18-4333-9C64-10DE93676363}"; Key: "APPLICATIONFLAGS") "msedgewebview2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{67082621-8D18-4333-9C64-10DE93676363}"; Key: "DEVICEID") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL\CLOCKDATA"; Key: "TICKCOUNT") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL\CLOCKDATA"; Key: "CLOCKTIMESECONDS") "msedgewebview2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\TOKEN\{67082621-8D18-4333-9C64-10DE93676363}"; Key: "DEVICETICKET") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL"; Key: "GLOBALDEVICEUPDATETIME") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL"; Key: "CLOCKSKEW") "msedgewebview2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\PROPERTY") "msedgewebview2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\IMMERSIVE\PRODUCTION\PROPERTY"; Key: "00180017009BEC0A") "msedgewebview2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL\TRACE")6d:T3920,Spawned process "7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe" (UID: 00000000-00007816) Spawned process "msedgewebview2.exe" with commandline "--embedded-browser-webview=1 --webview-exe-name=7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe --webview-exe-version=21.0.2 --user-data-dir="%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=7816.6780.1729321346947612973 /pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1" (UID: 00000000-00006572) Spawned process "msedgewebview2.exe" with commandline "--type=crashpad-handler --user-data-dir=%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView /prefetch:4 /pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1 --monitor-self-annotation=ptype=crashpad-handler --database=%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=144.0.7559.133 "--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=144.0.3719.115 --initial-client-data=0x1ec,0x1f0,0x1f4,0x1c8,0x1fc,0x7fffe9d82c98,0x7fffe9d82ca4,0x7fffe9d82cb0" (UID: 00000000-00007364) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView" --webview-exe-name=7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe --webview-exe-version=21.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1572,i,16450077786520241372,925124509225465512,262144 --field-trial-handle=1908,i,13731244950744697957,13544771968814208670,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1904 /prefetch:2 /pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1" (UID: 00000000-00001340) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView" --webview-exe-name=7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe --webview-exe-version=21.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=2184,i,15745787290697392152,2746551905863206498,524288 --field-trial-handle=1908,i,13731244950744697957,13544771968814208670,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2236 /prefetch:11 /pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1" (UID: 00000000-00006372) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView" --webview-exe-name=7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe --webview-exe-version=21.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=2372,i,9680261780002940036,4698795224413635522,524288 --field-trial-handle=1908,i,13731244950744697957,13544771968814208670,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2360 /prefetch:13 /pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1" (UID: 00000000-00007836) Spawned process "msedgewebview2.exe" with commandline "--type=renderer --noerrdialogs --user-data-dir="C:\\Users\\HA69nTn\\AppData\\Roaming\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView" --webview-exe-name=7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe --webview-exe-version=21.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--expose-gc --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1792109018018086 --launch-time-ticks=4763343333 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3420,i,6173131508378616821,10600971555043616898,2097152 --field-trial-handle=1908,i,13731244950744697957,13544771968814208670,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3424 /pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1 /prefetch:1" (UID: 00000000-00002160) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView" --webview-exe-name=7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe --webview-exe-version=21.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --skip-read-main-dll --metrics-shmem-handle=3756,i,5160423205812358446,9813730504416613704,262144 --field-trial-handle=1908,i,13731244950744697957,13544771968814208670,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3772 /prefetch:2 /pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1" (UID: 00000000-00007504) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView" --webview-exe-name=7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe --webview-exe-version=21.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=3864,i,2376124217191774682,11288511541682282841,524288 --field-trial-handle=1908,i,13731244950744697957,13544771968814208670,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=2996 /prefetch:13 /pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1" (UID: 00000000-00007116) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView" --webview-exe-name=7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe --webview-exe-version=21.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --skip-read-main-dll --metrics-shmem-handle=3772,i,13661194142205080969,6311763441822879248,262144 --field-trial-handle=1908,i,13731244950744697957,13544771968814208670,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4012 /prefetch:2 /pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1" (UID: 00000000-00008056) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView" --webview-exe-name=7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe --webview-exe-version=21.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=3868,i,17829027640206488344,15399177841871881150,524288 --field-trial-handle=1908,i,13731244950744697957,13544771968814208670,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3872 /prefetch:13 /pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1" (UID: 00000000-00005572) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView" --webview-exe-name=7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe --webview-exe-version=21.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --skip-read-main-dll --metrics-shmem-handle=3512,i,6668243018640514881,1006309649737296119,262144 --field-trial-handle=1908,i,13731244950744697957,13544771968814208670,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3620 /prefetch:2 /pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1" (UID: 00000000-00002544) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView" --webview-exe-name=7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe --webview-exe-version=21.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=3864,i,2924793298065951914,2981674918742282184,524288 --field-trial-handle=1908,i,13731244950744697957,13544771968814208670,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4204 /prefetch:13 /pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1" (UID: 00000000-00005016) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView" --webview-exe-name=7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe --webview-exe-version=21.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --skip-read-main-dll --metrics-shmem-handle=3620,i,5226424502715773139,6768845422770955226,262144 --field-trial-handle=1908,i,13731244950744697957,13544771968814208670,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4012 /prefetch:2 /pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1" (UID: 00000000-00006288) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView" --webview-exe-name=7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe --webview-exe-version=21.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=3868,i,9541629869153097142,10792180440301019283,524288 --field-trial-handle=1908,i,13731244950744697957,13544771968814208670,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=2996 /prefetch:13 /pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1" (UID: 00000000-00004380) Spawned process "msedgewebview2.exe" with commandline "--type=gpu-process --noerrdialogs --user-data-dir="%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView" --webview-exe-name=7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe --webview-exe-version=21.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --skip-read-main-dll --metrics-shmem-handle=452,i,16318523661069922038,2989951154303619312,262144 --field-trial-handle=1908,i,13731244950744697957,13544771968814208670,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=3852 /prefetch:2 /pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1" (UID: 00000000-00007660) Spawned process "msedgewebview2.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView" --webview-exe-name=7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe --webview-exe-version=21.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --skip-read-main-dll --metrics-shmem-handle=3864,i,13754356008072263069,9829373571980062403,524288 --field-trial-handle=1908,i,13731244950744697957,13544771968814208670,262144 --disable-features=msSmartScreenProtection --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4204 /prefetch:13 /pfhostedapp:ac79510dbd3ff0c673b43c6c9905640dc4052df1" (UID: 00000000-00002008)6e:Tfd9,Contains base64 string in header "http" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/expect HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Expectd: 100Accept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/expect HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Expectd: 100Accept-Encoding: gzip" Contains base64 string in header "1Expectd" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/expect HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Expectd: 100Accept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/expect HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Expectd: 100Accept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/expect HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Expectd: 100Accept-Encoding: gzip" Contains base64 string in header "/0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "http" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "http" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/config HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/config HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/config HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/config HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base64 string in header "http" in header "GET /+yxuLqpii3H42YTU6 HTTP/2Host: t.meUser-Agent: Go-http-client/2.0Accept-Encoding: gzip" Contains base64 string in header "client/2" in header "GET /+yxuLqpii3H42YTU6 HTTP/2Host: t.meUser-Agent: Go-http-client/2.0Accept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /+yxuLqpii3H42YTU6 HTTP/2Host: t.meUser-Agent: Go-http-client/2.0Accept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /+yxuLqpii3H42YTU6 HTTP/2Host: t.meUser-Agent: Go-http-client/2.0Accept-Encoding: gzip"6f:Tc19,"GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/expect HTTP/1.1 Host: web.yafeicoffee.com User-Agent: Go-http-client/1.1 Expectd: 100 Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Wed 28 Oct 2026 08:17:14 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=PCBOGFnqHx%2Bz5QO%2BTkjGzJkao2ZKjRvnDvVaF57nfmy7UptCejDu7k3zIeNlwA35kZ4zWj385get9Tzb1jMh3UEIAbzwcvU0FRfGEIt8G4ZQf4C0gSOQoekwg6gpqaHNUq%2FV%2FHdx"}]} CF-RAY: a51880bf1fe6173b-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear HTTP/1.1 Host: web.yafeicoffee.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Wed 28 Oct 2026 08:17:15 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=nsgDQe2yY%2Fgh2%2BG%2BQbPYBsQMJTXoYjfNhj9GvCB1F1WHYcUlmGAzN9qLZmVSMowLgA4lqBaBxHTc0mxdHKVJis7KB4sdKVISrUN5xY8Lf4oWEg3%2Bt%2BdHG5WanR9m7U%2BXdkSXNWpz"}]} CF-RAY: a51880c42bf7173b-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/config HTTP/1.1 Host: web.yafeicoffee.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Wed 28 Oct 2026 08:17:15 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=a6MxIuLK0wUzYa9K8%2FGSoR5IHLd%2FEL%2FSr%2Bxa%2FiAicI6e7%2FYGNY6P54zCUrEzrRTmChuywmsCPhBgFy0PjODxveoq8RVddikn7udFumYES6Xu90hJjQHESXc9cikCbBkoGBTTS5ng"}]} Content-Encoding: gzip CF-RAY: a51880c61d6c173b-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B22656E63223A223863545850684F356155576C396C5677706D5A30386D4A6438476E794356475A6D654A4B3637365071587741434773755632643255746745....... "GET /+yxuLqpii3H42YTU6 HTTP/2 Host: t.me User-Agent: Go-http-client/2.0 Accept-Encoding: gzip" Response ==> HTTP/2 200 OK Content-Type: text/html; charset=utf-8 Date: Wed 28 Oct 2026 08:17:13 GMT Server: nginx/1.30.1 Set-Cookie: stel_ssid=ea06dcda7998161d27_10450112404717611882; expires=Thu 29 Oct 2026 08:17:13 GMT; path=/; samesite=None; secure; HttpOnly Content-Security-Policy: frame-ancestors https://web.telegram.org X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Encoding: gzip Cache-Control: no-store Pragma: no-cache Strict-Transport-Security: max-age=35768000 with response body ==>BINARY_CONTENT.......70:T64a,Contains base62 string in header "0x07537e2e3d6DD58E8Bd7942b5b18436" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/expect HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Expectd: 100Accept-Encoding: gzip" Contains base62 string in header "0xCC1a5A65a6667cCE81612714DCD5Efd" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/expect HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Expectd: 100Accept-Encoding: gzip" Contains base62 string in header "0x07537e2e3d6DD58E8Bd7942b5b18436" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base62 string in header "0xCC1a5A65a6667cCE81612714DCD5Efd" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base62 string in header "0x07537e2e3d6DD58E8Bd7942b5b18436" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/config HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip" Contains base62 string in header "0xCC1a5A65a6667cCE81612714DCD5Efd" in header "GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/config HTTP/1.1Host: web.yafeicoffee.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip"71:T4c8,Found string "hostingcloud.racing/" (Indicator: "gcloud"; Source: "00000000-00004004.00000001.126420.002C0000.00000004.mdmp, 00000000-00004004.00000002.128342.002C0000.00000004.mdmp, 00000000-00004004.00000003.129437.002C0000.00000004.mdmp") Found string "\" (Indicator: \"SHA512\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 0A660000\n \"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 0A660000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"msedgewebview2.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2d","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2e","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"$2f","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"msedgewebview2.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006572-00000C2C-3424757026\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00006572-00000C2C-3427227680\")\n Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00006572-00000C2C-3427228419\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"00000000-00006572-00000C2C-3430733348\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; Source: \"00000000-00002160.00000000.305187.00198000.00000004.mdmp, 00000000-00002160.00000000.305187.00A04000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00006572-00000C2C-3433531577\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00006572-00000C2C-3433556000\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$30","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004380.00000000.306340.EE200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"file/memory contains long string with (Indicator: \"public key\"; Source: \"00000000-00002160.00000000.305187.351A0000.00000002.mdmp\")\n Found string \"=0 {Checking public key and integrity block\" (Indicator: \"public key\"; Source: \"00000000-00002160.00000000.305187.351A0000.00000002.mdmp\")\n Found string \"=1 {Checking public key and integrity block\" (Indicator: \"public key\"; Source: \"00000000-00002160.00000000.305187.351A0000.00000002.mdmp\")\n Found string \"other {Checking public key and integrity block\" (Indicator: \"public key\"; Source: \"00000000-00002160.00000000.305187.351A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$31","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"00000000-00002160.00000000.305187.351A0000.00000002.mdmp\")\n Found string \".c.youtube.com\" (Indicator: \"youtube.com\"; Source: \"00000000-00006372.00000000.304884.00004000.00000004.mdmp, 00000000-00006372.00000000.304884.00144000.00000004.mdmp, 00000000-00006372.00000000.304884.001D4000.00000004.mdmp, 00000000-00006372.00000001.306805.00004000.00000004.mdmp, 00000000-00006372.00000001.306805.00148000.00000004.mdmp, 00000000-00006372.00000001.306805.001D4000.00000004.mdmp, 00000000-00006372.00000002.308724.00004000.00000004.mdmp, 00000000-00006372.00000002.308724.00148000.00000004.mdmp, 00000000-00006372.00000002.308724.001D4000.00000004.mdmp, 00000000-00006372.00000003.309421.00004000.00000004.mdmp, 00000000-00006372.00000003.309421.00148000.00000004.mdmp, 00000000-00006372.00000003.309421.001D4000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007364-00000C2C-3462002589\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"BIOSVersion\" (Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found string \"OSVersionInformation\" (Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found string \"::GetUserNameW\" (Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007364-00000C2C-3462002589\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found string \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00006572-00000C2C-3431788557\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006572-00000C2C-3421372527\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"EnumServicesStatusExW\" (Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"file/memory contains long string with (Indicator: \"/cookies\"; Source: \"00000000-00002160.00000000.305187.351A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006372-00000C2C-3431260432\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"msedgewebview2.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006572)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"msedgewebview2.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006572)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007816)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"msedgewebview2.exe\" called \"IsWow64Process\" with parameter \"6572\" - (UID: 00000000-00006572)\n \"msedgewebview2.exe\" called \"IsWow64Process\" with parameter \"6572\" - (UID: 00000000-00007364)\n \"msedgewebview2.exe\" called \"IsWow64Process\" with parameter \"7364\" - (UID: 00000000-00007364)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"msedgewebview2.exe\" called \"GetWindowTextW\" with parameter \"Untitled\" - (UID: 00000000-00006572)\n \"msedgewebview2.exe\" called \"GetWindowTextW\" with parameter \"about:blank\" - (UID: 00000000-00006572)\n \"msedgewebview2.exe\" called \"GetWindowTextW\" with parameter \"RDP Access Verifier\" - (UID: 00000000-00006572)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"msedgewebview2.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006572)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$36","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"::IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"msedgewebview2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"msedgewebview2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Creates file in AppData directory","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-322","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to BIOS","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\BIOS\" (Indicator: \"hardware\\description\\system\\bios\") in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-350","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"Hardware\\Description\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")\n \"msedgewebview2.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{E122B924-B4ED-4437-BC94-A96B6AA901B6}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" queried token user identity (UID: 00000000-00007816)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"msedgewebview2.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"msedgewebview2.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$38","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"msedgewebview2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"msedgewebview2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"msedgewebview2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CHROME.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"NtOpenProcess\" (Indicator: \"NtOpenProcess\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetProcessHeaps\" (Indicator: \"GetProcessHeaps\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$39","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"msedgewebview2.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3a","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"msedgewebview2.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe\" --type=utility --utility-sub-type=net\" - (UID: 00000000-00006572)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"$3b","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$3d","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryAndGetError\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"RegDisablePredefinedCache\" (Indicator: \"RegDisablePredefinedCache\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"e.TotalTakenTimeForDidLoadResourceFromMemoryCache\" (Indicator: \"LoadResource\"; Source: \"00000000-00002160.00000000.305187.0070C000.00000004.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"AttemptToNotifyRunningChrome:GetWindowThreadProcessId failed\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$43","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$44","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"msedgewebview2.exe\" failed to load missing module \"MDMRegistration.dll\" - [base:0; Status:c000000d]\n \"msedgewebview2.exe\" failed to load missing module \"netapi32.dll\" - [base:0; Status:c000000d]\n \"msedgewebview2.exe\" failed to load missing module \"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\dbghelp.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"knoll@kde.org\"\n Pattern match: \"appro@openssl.org\"\n Pattern match: \"_ke@smct.io\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00002160.00000000.305187.000A0000.00000004.mdmp, 00000000-00002160.00000000.305187.00108000.00000004.mdmp, 00000000-00002160.00000001.307105.000A0000.00000004.mdmp, 00000000-00002160.00000002.309025.000A0000.00000004.mdmp, 00000000-00002160.00000002.309025.00108000.00000004.mdmp, 00000000-00002160.00000003.309414.000A0000.00000004.mdmp, 00000000-00002160.00000003.309414.00108000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"$45","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$46","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$47","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 15A80000\n \"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 15A80000\n \"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 15170000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 181F0000\n \"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 181F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00000000002042f515f87f0000@ntdll.dll\"\n \"22002300000000004042f515f87f0000@ntdll.dll\"\n \"1000110000000000f8a870e8ff7f0000@ntdll.dll\"\n \"0f0010000000000010a970e8ff7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$48","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" has an writable section named \".data\"\n \"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" has an writable section named \".idata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" file has an entrypoint instructions - \"jmp\t0x14008bd00,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\trbp,mov\trbp, rsp,pushfq\t,cld\t,sub\trsp, 0xe0,mov\tqword ptr [rsp], rdi,mov\tqword ptr [rsp + 8], rsi,mov\tqword ptr [rsp + 0x10], rbp,mov\tqword ptr [rsp + 0x18], rbx,mov\tqword ptr [rsp + 0x20], r12,mov\tqword ptr [rsp + 0x28], r13,mov\tqword ptr [rsp + 0x30], r14,mov\tqword ptr [rsp + 0x38], r15,movups\txmmword ptr [rsp + 0x40], xmm6,movups\txmmword ptr [rsp + 0x50], xmm7,movups\txmmword ptr [rsp + 0x60], xmm8,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x4e0600\" greater than 0x100000\n Raw size of \".rdata\" is \"0x64f800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x4e05b1\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x64f638\" greater than 0x100000\n Virtual size of \".data\" is \"0x211cfa8\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$49","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\ntmarta.dll\" [Source: 00000000-00006572-00000C2B-3421199540]\n Observed system executable string:\"%WINDIR%\\system32\\wldp.dll\" [Source: 00000000-00006572-00000C2B-3430539579]\n Observed system executable string:\"%WINDIR%\\system32\\shcore.dll\" [Source: 00000000-00006572-00000C2B-3431426048]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"msedgewebview2.exe\" searching for class \"Chrome_MessageWindow\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$4b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$4c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Certum Trusted Network CA 2, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL\" (SHA1: 8D:57:E2:B4:00:8B:BE:46:14:70:A6:9F:34:92:BC:5A:E3:62:A7:A9; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Certum Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL\" (SHA1: D9:C2:6F:34:67:74:0C:4E:CA:2A:B7:54:40:4B:D5:E2:6A:5D:43:57; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"msedgewebview2.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Crashpad\\temp\\edge_shutdown_crash.txt\"\n \"msedgewebview2.exe\" writes to a file \"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Crashpad\\temp\\edge_shutdown_crash.txt\"\n \"msedgewebview2.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\sslkey.txt\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"file/memory contains long string(Source: \"00000000-00002160.00000000.305187.351A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"msedgewebview2.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4e","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$4f","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$50","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" queries basic process information of the \"C:\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" (UID: 7816)\n \"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" queries basic process information of the \"C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\msedgewebview2.exe\" (UID: 7816)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$51","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" reads file \"\\device\\namedpipe\\local\\mojo.7816.6780.1729321346947612973\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Calls an API typically used to find device information\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$54","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"msedgewebview2.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\ebwebview\\crashpad\\throttle_store.dat\"\n \"msedgewebview2.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\ebwebview\\crashpad\\settings.dat\"\n \"msedgewebview2.exe\" writes file \"\\device\\namedpipe\\wkssvc\"\n \"msedgewebview2.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\ebwebview\\variations\"\n \"msedgewebview2.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\ebwebview\\edge-local-state-tmp-eccaa385-d549-424a-8f96-148c3e2a2bbf.tmp\"\n \"msedgewebview2.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\ebwebview\\shadercache\\index\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"$55","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Network Related","name":"Able to download payload via Wget","description":"file/memory contains long string(Source: \"00000000-00002160.00000000.305187.351A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-963","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping Identity\" (Indicator: \"ping \"; Source: \"00000000-00006372.00000000.304884.00024000.00000004.mdmp, 00000000-00006372.00000000.304884.00328000.00000004.mdmp, 00000000-00006372.00000000.304884.00454000.00000004.mdmp, 00000000-00006372.00000001.306805.00024000.00000004.mdmp, 00000000-00006372.00000001.306805.00328000.00000004.mdmp, 00000000-00006372.00000001.306805.00454000.00000004.mdmp, 00000000-00006372.00000002.308724.00024000.00000004.mdmp, 00000000-00006372.00000002.308724.00328000.00000004.mdmp, 00000000-00006372.00000002.308724.00454000.00000004.mdmp, 00000000-00006372.00000003.309421.00024000.00000004.mdmp, 00000000-00006372.00000003.309421.00328000.00000004.mdmp, 00000000-00006372.00000003.309421.00454000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve cloud service dashboard","description":"file/memory contains long string(Source: \"00000000-00002160.00000000.305187.351A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1538","relevance":1,"id":"string-777","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"msedgewebview2.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"14ed427e9f0\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"3872\"\n \"dwContext\": \"0\"\n \"$error\": \"2ee7\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"edgeInternetConnectivityPrivate\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002160.00000000.305187.0005C000.00000004.mdmp, 00000000-00002160.00000000.305187.0014C000.00000004.mdmp, 00000000-00002160.00000000.305187.005C8000.00000004.mdmp, 00000000-00002160.00000001.307105.0005C000.00000004.mdmp, 00000000-00002160.00000002.309025.0014C000.00000004.mdmp, 00000000-00002160.00000002.309025.005C8000.00000004.mdmp, 00000000-00002160.00000003.309414.0005C000.00000004.mdmp, 00000000-00002160.00000003.309414.0014C000.00000004.mdmp, 00000000-00002160.00000003.309414.005C8000.00000004.mdmp\")\n Found reference to API \"permission:edgeInternetConnectivityPrivate\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002160.00000000.305187.00554000.00000004.mdmp, 00000000-00002160.00000001.307105.00554000.00000004.mdmp, 00000000-00002160.00000002.309025.00554000.00000004.mdmp, 00000000-00002160.00000003.309414.00554000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"ImpersonateNamedPipeClient\" (Indicator: \"ImpersonateNamedPipeClient\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"::GetNamedPipeClientProcessId\" (Indicator: \"GetNamedPipe\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"8.0.0.0\"\n Potential IP \"44.0.0.0\" found in string \"44.0.0.0 Safari/537.36\"\n Potential IP \"144.0.0.0\" found in string \"0 Safari/537.36 Edg/144.0.0.0\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0-devel\"\n \"0.0.0.0\"\n \"0.0.0.1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$59","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"details too long to display","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.0H9\" (Indicator: \"HTTP/1.0\"; File: \"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\")\n Found string \"HTTP/1.1H9\" (Indicator: \"HTTP/1.1\"; File: \"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002160.00000000.305187.0014C000.00000004.mdmp, 00000000-00002160.00000000.305187.00728000.00000004.mdmp\")\n Found string \"HTTP/1.1 404 Not Found\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002160.00000002.309025.0014C000.00000004.mdmp, 00000000-00002160.00000003.309414.0014C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"Identified known pipe name","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00006572-00000CCE-3423045124\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":3,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"Found string \"C:\\WINDOWS\\system32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00006372.00000000.304884.00024000.00000004.mdmp, 00000000-00006372.00000001.306805.00024000.00000004.mdmp, 00000000-00006372.00000002.308724.00024000.00000004.mdmp, 00000000-00006372.00000003.309421.00024000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://localhost:86\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00006572\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"CreateWindowStationW\" (Indicator: \"CreateWindowStation\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"::WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"file/memory contains long string with (Indicator: \"1password\"; File: \"Login Data\")","origin":"File/Memory","mitre_attack_id":"T1555.005","relevance":3,"id":"string-10057","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegGetValueW\" in \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExA\" in \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"msedgewebview2.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 0A550000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"msedgewebview2.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00006572)\n \"msedgewebview2.exe\" called \"FindNextFileW\" with parameter BrowserMetrics (UID: 00000000-00006572)\n \"msedgewebview2.exe\" called \"FindNextFileW\" with parameter Crashpad (UID: 00000000-00006572)\n \"msedgewebview2.exe\" called \"FindNextFileW\" with parameter lockfile (UID: 00000000-00006572)\n \"msedgewebview2.exe\" called \"FindNextFileW\" with parameter index (UID: 00000000-00006572)\n \"msedgewebview2.exe\" called \"FindNextFileW\" with parameter CURRENT (UID: 00000000-00006572)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"msedgewebview2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"msedgewebview2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"28\"\n \"th32ProcessID\": \"6572\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"msedgewebview2.exe\" called \"GetComputerNameW\" (UID: 00000000-00006572)\n \"msedgewebview2.exe\" called \"GetComputerNameW\" (UID: 00000000-00006372)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"msedgewebview2.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"msedgewebview2.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"msedgewebview2.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"8\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExFromAppW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"FindFirstFileEx\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"__vcrt_GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004380.00000000.306340.FC1D4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA failed with code\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$60","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Ping Identity\" (Indicator: \"ping\"; Source: \"00000000-00006372.00000000.304884.00024000.00000004.mdmp, 00000000-00006372.00000000.304884.00328000.00000004.mdmp, 00000000-00006372.00000000.304884.00454000.00000004.mdmp, 00000000-00006372.00000001.306805.00024000.00000004.mdmp, 00000000-00006372.00000001.306805.00328000.00000004.mdmp, 00000000-00006372.00000001.306805.00454000.00000004.mdmp, 00000000-00006372.00000002.308724.00024000.00000004.mdmp, 00000000-00006372.00000002.308724.00328000.00000004.mdmp, 00000000-00006372.00000002.308724.00454000.00000004.mdmp, 00000000-00006372.00000003.309421.00024000.00000004.mdmp, 00000000-00006372.00000003.309421.00328000.00000004.mdmp, 00000000-00006372.00000003.309421.00454000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0003\"; Key: \"PROFILEENUMMODE\")\n \"msedgewebview2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0003\"; Key: \"ICMPROFILE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"msedgewebview2.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006572)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$61","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileAfterReboot\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"DoDeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"RemoveDirectory\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002160.00000000.305187.000E0000.00000004.mdmp\n 00000000-00002160.00000000.305187.00414000.00000004.mdmp\n 00000000-00002160.00000000.305187.00554000.00000004.mdmp\n 00000000-00002160.00000001.307105.00554000.00000004.mdmp\n 00000000-00002160.00000002.309025.00554000.00000004.mdmp\n 00000000-00002160.00000003.309414.00554000.00000004.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002544.00000000.305966.6C58D000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002160.00000003.309414.E8ACD000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"msedgewebview2.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" opened \"\\Device\\KsecDD\"\n \"msedgewebview2.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$65","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$66","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\"geniusmonkey.com\" (Source: 00000000-00006372.00000000.304884.00024000.00000004.mdmp, 00000000-00006372.00000001.306805.00024000.00000004.mdmp, 00000000-00006372.00000002.308724.00024000.00000004.mdmp, 00000000-00006372.00000003.309421.00024000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$67","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".text\" unusually large (5113265 bytes)\n possible junk padding\n Section \".rdata\" unusually large (6616632 bytes)\n possible junk padding\n Section \".data\" unusually large (34721704 bytes)\n possible junk padding\n Section \".symtab\" has very low entropy (0.02)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"msedgewebview2.exe\" at 00000000-00006572-00000C15-3435667318","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"C:\\WINDOWS\\SYSTEM32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00002160.00000000.305187.33813000.00000004.mdmp, 00000000-00002160.00000001.307105.33813000.00000004.mdmp, 00000000-00002160.00000002.309025.33813000.00000004.mdmp, 00000000-00002160.00000003.309414.33813000.00000004.mdmp\")\n Found string \"\\??\\C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\144.0.3719.115\\144.0.3719.115\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00002160.00000000.305187.33813000.00000004.mdmp, 00000000-00002160.00000001.307105.33813000.00000004.mdmp, 00000000-00002160.00000002.309025.33813000.00000004.mdmp, 00000000-00002160.00000003.309414.33813000.00000004.mdmp\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")\n Found string \"Library dbghelp.dll is not loaded\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00002544.00000000.305966.6C58D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to convert data from binary to string","description":"$68","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-230","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"suspicious","category":"Cryptographic Related","name":"References bcrypt module and functions (used for encryption/decryption)","description":"Found AES encryption functions \"['BCryptOpenAlgorithmProvider', 'BCryptCloseAlgorithmProvider', 'BCryptGenRandom', 'bcrypt.dll']\" - Source: \"00000000-00006572.00000003.309397.E9082000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1573","relevance":5,"id":"memorydump-14","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$69","origin":"File/Memory","mitre_attack_id":"T1491.001","relevance":5,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"msedgewebview2.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\ce1dca8a9cdc2f790f3d2506ef7f093e1f0fd27a.tbres\" for deletion\n \"msedgewebview2.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\de8c8566573dcad173c794780648c7dd382dff10.tbres\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$6a","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"suspicious","category":"System Security","name":"Deletes registry keys","description":"\"msedgewebview2.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\EDGEWEBVIEW\\PREFERENCEMACS\\DEFAULT\"; Key: \"EXTENSIONS.SETTINGS\"; Value: \"\")\n \"msedgewebview2.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\EDGEWEBVIEW\\PREFERENCEMACS\\DEFAULT\"; Key: \"SCHEDULE_TO_FLUSH_TO_DISK\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1070","relevance":3,"id":"registry-170","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateThread\n LoadLibraryExW\n WriteFile\n GetSystemDirectoryA\n GetThreadContext\n VirtualAlloc\n GetProcAddress\n GetSystemInfo","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$6b","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$6c","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$6d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$6e","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Telegram Domain (t .me in TLS SNI)\" (SID: 2041933, Rev: 2, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Observed Telegram Domain in TLS SNI (t .me)\" (SID: 2071570, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"web.yafeicoffee.com\"\n \"t.me\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"149.154.167.99:443\"\n \"104.21.57.209:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"~a)paypal.com.au\" (Indicator: \"paypal.com\")\n \"yandex.com.ge\" (Indicator: \"yandex.com\")\n \"paypal.com.mx\" (Indicator: \"paypal.com\")\n \"Wpaypal.com.tr\" (Indicator: \"paypal.com\")\n \"Fyandex.com.am\" (Indicator: \"yandex.com\")\n \"paypal.com.ar\" (Indicator: \"paypal.com\")\n \"Iyandex.com\" (Indicator: \"yandex.com\")\n \"Spaypal.com\" (Indicator: \"paypal.com\")\n \"/Cpaypal.com.tw\" (Indicator: \"paypal.com\")\n \"paypal.com.ve\" (Indicator: \"paypal.com\")\n \"[github.com\" (Indicator: \"github.com\")\n \"yandex.com.tr\" (Indicator: \"yandex.com\")\n \"paypal.com.pe\" (Indicator: \"paypal.com\")\n \"paypal.com/\" (Indicator: \"paypal.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$6f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"t.me\"\n \"web.yafeicoffee.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"msedgewebview2.exe\" called \"NtQueueApcThread\" (UID: 00000000-00008700)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"msedgewebview2.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1d3ada72f00\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/expect\"\n Found http requests in header \"GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear\"\n Found http requests in header \"GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/config\"\n Found http requests in header \"GET /+yxuLqpii3H42YTU6\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"fq%umx.\" [Source: 00000000-00004004.00000001.126420.000D0000.00000004.mdmp\n 00000000-00004004.00000002.128342.000D0000.00000004.mdmp\n 00000000-00004004.00000003.129437.000D0000.00000004.mdmp]\n Observed email domain:\"silverpop.com/\" [Source: 00000000-00004004.00000001.126420.002C0000.00000004.mdmp\n 00000000-00004004.00000002.128342.002C0000.00000004.mdmp\n 00000000-00004004.00000003.129437.002C0000.00000004.mdmp]\n Observed email domain:\"a-mx.com\" [Source: 00000000-00004004.00000001.126420.002C0000.00000004.mdmp\n 00000000-00004004.00000002.128342.002C0000.00000004.mdmp\n 00000000-00004004.00000003.129437.002C0000.00000004.mdmp]\n Observed email domain:\"a-mx.com/\" [Source: 00000000-00004004.00000002.128342.00214000.00000004.mdmp\n 00000000-00004004.00000003.129437.00214000.00000004.mdmp]\n Observed email domain:\"my.mail.ru/\" [Source: 00000000-00004004.00000002.128342.00298000.00000004.mdmp\n 00000000-00004004.00000003.129437.00298000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/expect HTTP/1.1\nHost: web.yafeicoffee.com\nUser-Agent: Go-http-client/1.1\nExpectd: 100\nAccept-Encoding: gzip\n\n GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear HTTP/1.1\nHost: web.yafeicoffee.com\nUser-Agent: Go-http-client/1.1\nAccept-Encoding: gzip\n\n GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/config HTTP/1.1\nHost: web.yafeicoffee.com\nUser-Agent: Go-http-client/1.1\nAccept-Encoding: gzip\n\n GET /+yxuLqpii3H42YTU6 HTTP/2\nHost: t.me\nUser-Agent: Go-http-client/2.0\nAccept-Encoding: gzip\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$70","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://web.yafeicoffee.com/0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/expect\n Found HTTPS GET request to https://web.yafeicoffee.com/0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear\n Found HTTPS GET request to https://web.yafeicoffee.com/0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/config\n Found HTTPS GET request to https://t.me/+yxuLqpii3H42YTU6","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"web.yafeicoffee.com\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"149.154.167.99\" on port \"443\"\n HTTPS traffic to \"104.21.57.209\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"informative","category":"Remote Access Related","name":"Able to connect to a cloud service","description":"$71","origin":"File/Memory","mitre_attack_id":"T1021.007","relevance":1,"id":"string-767","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"msedgewebview2.exe queries ProcessDebugPort (UID: 8292)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/26 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 149.154.167.99 on port 443 is sent without HTTP header\n TCP traffic to 104.21.57.209 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$72","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]}],"intel_graph":{"map":{"Domain:t.me":{"type":"Domain","value":"t.me"},"Domain:web.yafeicoffee.com":{"type":"Domain","value":"web.yafeicoffee.com"},"File:00f3a870088e1d0ede48b1a7a82af8bf30aadb59d2a1f12d721a5b79c174a66d":{"type":"File","value":"00f3a870088e1d0ede48b1a7a82af8bf30aadb59d2a1f12d721a5b79c174a66d"},"File:05a640fdab2f0d4975df593177eccb89d6b5251b0c44361f190dd0fa98d01102":{"type":"File","value":"05a640fdab2f0d4975df593177eccb89d6b5251b0c44361f190dd0fa98d01102"},"File:07a486481337b6b8670db113207cfe2547929490e12951ca9e59f21c549919cd":{"type":"File","value":"07a486481337b6b8670db113207cfe2547929490e12951ca9e59f21c549919cd"},"File:1f72f7e2611749659563cc227a1c71888944b213a23581966188483fb9e31cba":{"type":"File","value":"1f72f7e2611749659563cc227a1c71888944b213a23581966188483fb9e31cba"},"File:281cd09e94508c36553f4ee5ca46bdd20bcbe6d9fc91a091b4a60688964c4386":{"type":"File","value":"281cd09e94508c36553f4ee5ca46bdd20bcbe6d9fc91a091b4a60688964c4386","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:35b617fb3c6495ba0ac4eca009b271c34e842b347ba8a45c6d7b71d414a03eea":{"type":"File","value":"35b617fb3c6495ba0ac4eca009b271c34e842b347ba8a45c6d7b71d414a03eea"},"File:41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304":{"type":"File","value":"41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304"},"File:553b2137cbddfa83806636dea3f68872957e38bea50a6716fbd8ab6b38b09b22":{"type":"File","value":"553b2137cbddfa83806636dea3f68872957e38bea50a6716fbd8ab6b38b09b22"},"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2":{"type":"File","value":"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file"]},"filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 9 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:8428e477566587d745da61d14df52ec7575ef0fe49ea2025374340afec3a51d6":{"type":"File","value":"8428e477566587d745da61d14df52ec7575ef0fe49ea2025374340afec3a51d6"},"File:953e1666b233347072cd57d586c7138f8015752bafee76be1a14b1c8b93e58ec":{"type":"File","value":"953e1666b233347072cd57d586c7138f8015752bafee76be1a14b1c8b93e58ec"},"File:a273b19c8d96d0cc62200a829a22f88c3f08f64a6f0bb4597c8915e40ab68aef":{"type":"File","value":"a273b19c8d96d0cc62200a829a22f88c3f08f64a6f0bb4597c8915e40ab68aef"},"File:a751c8b004feb14257c17fda3964df1ea376ae0750ec7dabaabb93509d4d4b71":{"type":"File","value":"a751c8b004feb14257c17fda3964df1ea376ae0750ec7dabaabb93509d4d4b71"},"File:aa05b23aa39cdef7caa2534cb1b4f5dcb479485b7baf9b758ab3479baff0c1c7":{"type":"File","value":"aa05b23aa39cdef7caa2534cb1b4f5dcb479485b7baf9b758ab3479baff0c1c7"},"File:b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec":{"type":"File","value":"b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec"},"File:b51b5089f5c767ff2a89608caa9c9a9e44ce3aca34e9c29677d59e39c272c14c":{"type":"File","value":"b51b5089f5c767ff2a89608caa9c9a9e44ce3aca34e9c29677d59e39c272c14c"},"File:b9dcfd31bc7c89948790a8bec55f3e39c3225cc34e89da2398fc7e6903e0c743":{"type":"File","value":"b9dcfd31bc7c89948790a8bec55f3e39c3225cc34e89da2398fc7e6903e0c743"},"File:d1d625ca52cf7ab50f331b3878f1989a2eef9f6d4dfdd5f0129e16367d0e2787":{"type":"File","value":"d1d625ca52cf7ab50f331b3878f1989a2eef9f6d4dfdd5f0129e16367d0e2787"},"File:d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e":{"type":"File","value":"d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e"},"File:d8e811ba103c6a039e00f55bb76fc084431977532dc261a709a72473d301da83":{"type":"File","value":"d8e811ba103c6a039e00f55bb76fc084431977532dc261a709a72473d301da83"},"File:e05c77c1dffd521beaa87ae2ee5d3a169e925bbabb7efd15a813fa0507e5a3c8":{"type":"File","value":"e05c77c1dffd521beaa87ae2ee5d3a169e925bbabb7efd15a813fa0507e5a3c8"},"File:e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c":{"type":"File","value":"e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c"},"File:e5ad462dfdd2f3aefb677c43036c47a4408521c246849c815dba70820c68625e":{"type":"File","value":"e5ad462dfdd2f3aefb677c43036c47a4408521c246849c815dba70820c68625e"},"File:e60cf58cb57f13f157848d957bb46ba5925845ecfd3ecff2c7babf9df81421aa":{"type":"File","value":"e60cf58cb57f13f157848d957bb46ba5925845ecfd3ecff2c7babf9df81421aa"},"File:ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7":{"type":"File","value":"ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7"},"File:fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d":{"type":"File","value":"fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d"},"Ip:104.21.57.209":{"type":"Ip","value":"104.21.57.209"},"Ip:149.154.167.99":{"type":"Ip","value":"149.154.167.99"},"Url:/+yxuLqpii3H42YTU6":{"type":"Url","value":"/+yxuLqpii3H42YTU6"},"Url:/0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear":{"type":"Url","value":"/0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear"},"Url:/0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/config":{"type":"Url","value":"/0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/config"},"Url:/0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/expect":{"type":"Url","value":"/0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/expect"}},"chains":[{"id":"1564915744840243876","root":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file"]}},{"id":"1564915733077176176","root":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:281cd09e94508c36553f4ee5ca46bdd20bcbe6d9fc91a091b4a60688964c4386"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","edges":[{"edge_kind":"contacted_ip","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"Ip:149.154.167.99"},{"edge_kind":"contacted_ip","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"Ip:104.21.57.209"},{"edge_kind":"contacted_domain","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"Domain:t.me"},{"edge_kind":"resolves_to","from_key":"Domain:t.me","to_key":"Ip:149.154.167.99"},{"edge_kind":"contacted_domain","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"Domain:web.yafeicoffee.com"},{"edge_kind":"resolves_to","from_key":"Domain:web.yafeicoffee.com","to_key":"Ip:104.21.57.209"},{"edge_kind":"contacted_url","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"Url:/0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/expect"},{"edge_kind":"contacted_url","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"Url:/0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear"},{"edge_kind":"contacted_url","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"Url:/0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/config"},{"edge_kind":"contacted_url","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"Url:/+yxuLqpii3H42YTU6"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","edges":[{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:281cd09e94508c36553f4ee5ca46bdd20bcbe6d9fc91a091b4a60688964c4386"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:07a486481337b6b8670db113207cfe2547929490e12951ca9e59f21c549919cd"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:e5ad462dfdd2f3aefb677c43036c47a4408521c246849c815dba70820c68625e"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:a751c8b004feb14257c17fda3964df1ea376ae0750ec7dabaabb93509d4d4b71"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:05a640fdab2f0d4975df593177eccb89d6b5251b0c44361f190dd0fa98d01102"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:00f3a870088e1d0ede48b1a7a82af8bf30aadb59d2a1f12d721a5b79c174a66d"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:e60cf58cb57f13f157848d957bb46ba5925845ecfd3ecff2c7babf9df81421aa"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:953e1666b233347072cd57d586c7138f8015752bafee76be1a14b1c8b93e58ec"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:d8e811ba103c6a039e00f55bb76fc084431977532dc261a709a72473d301da83"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:b9dcfd31bc7c89948790a8bec55f3e39c3225cc34e89da2398fc7e6903e0c743"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:e05c77c1dffd521beaa87ae2ee5d3a169e925bbabb7efd15a813fa0507e5a3c8"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:35b617fb3c6495ba0ac4eca009b271c34e842b347ba8a45c6d7b71d414a03eea"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:1f72f7e2611749659563cc227a1c71888944b213a23581966188483fb9e31cba"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:a273b19c8d96d0cc62200a829a22f88c3f08f64a6f0bb4597c8915e40ab68aef"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:553b2137cbddfa83806636dea3f68872957e38bea50a6716fbd8ab6b38b09b22"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:aa05b23aa39cdef7caa2534cb1b4f5dcb479485b7baf9b758ab3479baff0c1c7"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:b51b5089f5c767ff2a89608caa9c9a9e44ce3aca34e9c29677d59e39c272c14c"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:d1d625ca52cf7ab50f331b3878f1989a2eef9f6d4dfdd5f0129e16367d0e2787"},{"edge_kind":"extracted","from_key":"File:7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","to_key":"File:8428e477566587d745da61d14df52ec7575ef0fe49ea2025374340afec3a51d6"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":59,"spawned_processes_count":59,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":138,"imported_dlls_count":149,"dropped_files_count":0,"extracted_files_count":25,"files_written_count":305,"files_deleted_count":0,"registry_keys_created_count":21,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":22,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files","Sample Crashed","Network Traffic"],"sandbox_reports":[{"id":"6ae1af535c480b9059079b91","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["NLD","USA"],"submit_name":"RDP OfficeX Manager.exe","analysis_start_time":"2026-10-28T08:16:22+00:00","indicators_count":{"informative":153,"suspicious":46,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"6ad1756cef99abc0680d0b67","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"submit_name":"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe","analysis_start_time":"2026-10-16T00:55:03+00:00","indicators_count":{"informative":218,"suspicious":40,"malicious":4},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"address":"104.21.57.209","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]}],"dns_resolutions":[{"domain":"t.me","address":"149.154.167.99","ttl":54,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"domain":"web.yafeicoffee.com","address":"104.21.57.209","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]}],"http_requests":[{"host":"web.yafeicoffee.com","host_ip":"104.21.57.209:443","url":"/0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/expect","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/expect HTTP/1.1\nHost: web.yafeicoffee.com\nUser-Agent: Go-http-client/1.1\nExpectd: 100\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"host":"web.yafeicoffee.com","host_ip":"104.21.57.209:443","url":"/0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/clear HTTP/1.1\nHost: web.yafeicoffee.com\nUser-Agent: Go-http-client/1.1\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"host":"web.yafeicoffee.com","host_ip":"104.21.57.209:443","url":"/0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/config","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /0x07537e2e3d6DD58E8Bd7942b5b184368729486A9/0xCC1a5A65a6667cCE81612714DCD5Efdd8bD93c09/config HTTP/1.1\nHost: web.yafeicoffee.com\nUser-Agent: Go-http-client/1.1\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"host":"t.me","host_ip":"149.154.167.99:443","url":"/+yxuLqpii3H42YTU6","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /+yxuLqpii3H42YTU6 HTTP/2\nHost: t.me\nUser-Agent: Go-http-client/2.0\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}],"processes":[{"pid":5860,"ppid":0,"name":"RDPOfficeXManager.exe","command_line":"","sha256":"7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2","normalized_path":"C:\\RDPOfficeXManager.exe","uid":"00000000-00005860","icon":"$73"},{"pid":8292,"ppid":5860,"name":"msedgewebview2.exe","command_line":"--embedded-browser-webview=1 --webview-exe-name=RDPOfficeXManager.exe --webview-exe-version=21.0.2 --user-data-dir=\"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=5860.4284.8352252828937570342","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00005860","uid":"00000000-00008292"},{"pid":8700,"ppid":8292,"name":"msedgewebview2.exe","command_line":"--type=crashpad-handler --user-data-dir=%APPDATA%\\RDPOfficeXManager.exe\\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=141.0.7390.66 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe\" --annotation=plat=Win64 \"--annotation=prod=Edge WebView2\" --annotation=ver=141.0.3537.71 --initial-client-data=0x1e8,0x1ec,0x1f0,0x1c4,0x1f8,0x7ffdd67ca9d8,0x7ffdd67ca9e4,0x7ffdd67ca9f0","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00008700"},{"pid":6204,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$74","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00006204"},{"pid":8708,"ppid":6204,"name":"WerFault.exe","command_line":"-u -p 6204 -s 392","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00006204","uid":"00000000-00008708"},{"pid":4004,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$75","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00004004"},{"pid":6896,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$76","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00006896"},{"pid":9104,"ppid":6896,"name":"WerFault.exe","command_line":"-u -p 6896 -s 376","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00006896","uid":"00000000-00009104"},{"pid":9048,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$77","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00009048"},{"pid":8944,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$78","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00008944"},{"pid":5092,"ppid":8944,"name":"WerFault.exe","command_line":"-u -p 8944 -s 352","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008944","uid":"00000000-00005092"},{"pid":1388,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$79","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00001388"},{"pid":4876,"ppid":1388,"name":"WerFault.exe","command_line":"-u -p 1388 -s 376","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00001388","uid":"00000000-00004876"},{"pid":8140,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$7a","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00008140"},{"pid":4368,"ppid":8140,"name":"WerFault.exe","command_line":"-u -p 8140 -s 396","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008140","uid":"00000000-00004368"},{"pid":6688,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$7b","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00006688"},{"pid":3152,"ppid":6688,"name":"WerFault.exe","command_line":"-u -p 6688 -s 388","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00006688","uid":"00000000-00003152"},{"pid":5268,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$7c","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00005268"},{"pid":1496,"ppid":5268,"name":"WerFault.exe","command_line":"-u -p 5268 -s 392","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00005268","uid":"00000000-00001496"},{"pid":8276,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$7d","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00008276"},{"pid":8,"ppid":8276,"name":"WerFault.exe","command_line":"-u -p 8276 -s 360","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008276","uid":"00000000-00000008"},{"pid":8652,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$7e","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00008652"},{"pid":5372,"ppid":8652,"name":"WerFault.exe","command_line":"-u -p 8652 -s 400","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008652","uid":"00000000-00005372"},{"pid":8304,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$7f","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00008304"},{"pid":5632,"ppid":8304,"name":"WerFault.exe","command_line":"-u -p 8304 -s 376","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008304","uid":"00000000-00005632"},{"pid":2360,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$80","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00002360"},{"pid":7264,"ppid":2360,"name":"WerFault.exe","command_line":"-u -p 2360 -s 400","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002360","uid":"00000000-00007264"},{"pid":6104,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$81","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00006104"},{"pid":9000,"ppid":6104,"name":"WerFault.exe","command_line":"-u -p 6104 -s 380","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00006104","uid":"00000000-00009000"},{"pid":8300,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$82","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00008300"},{"pid":5172,"ppid":8300,"name":"WerFault.exe","command_line":"-u -p 8300 -s 396","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008300","uid":"00000000-00005172"},{"pid":8104,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$83","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00008104"},{"pid":9028,"ppid":8104,"name":"WerFault.exe","command_line":"-u -p 8104 -s 396","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008104","uid":"00000000-00009028"},{"pid":8344,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$84","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00008344"},{"pid":8624,"ppid":8344,"name":"WerFault.exe","command_line":"-u -p 8344 -s 392","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008344","uid":"00000000-00008624"},{"pid":8220,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$85","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00008220"},{"pid":2012,"ppid":8220,"name":"WerFault.exe","command_line":"-u -p 8220 -s 360","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008220","uid":"00000000-00002012"},{"pid":3412,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$86","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00003412"},{"pid":6328,"ppid":3412,"name":"WerFault.exe","command_line":"-u -p 3412 -s 392","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003412","uid":"00000000-00006328"},{"pid":436,"ppid":8292,"name":"msedgewebview2.exe","command_line":"$87","sha256":"5579d74e31c32f2ae057b1e3d4a999e8a753c590051d54eac2ff90428b802b26","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeWebView\\Application\\141.0.3537.71\\msedgewebview2.exe","parent_uid":"00000000-00008292","uid":"00000000-00000436"},{"pid":4632,"ppid":436,"name":"WerFault.exe","command_line":"-u -p 436 -s 388","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00000436","uid":"00000000-00004632"},{"pid":8556,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 468 -p 6204 -ip 6204","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00008556","icon":"$88"},{"pid":8212,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 424 -p 6896 -ip 6896","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00008212","icon":"$89"},{"pid":8524,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 536 -p 8944 -ip 8944","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00008524","icon":"$8a"},{"pid":8820,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 536 -p 1388 -ip 1388","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00008820","icon":"$8b"},{"pid":5004,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 568 -p 8140 -ip 8140","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00005004","icon":"$8c"},{"pid":7368,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 584 -p 6688 -ip 6688","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007368","icon":"$8d"},{"pid":8868,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 584 -p 5268 -ip 5268","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00008868","icon":"$8e"},{"pid":1164,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 596 -p 8276 -ip 8276","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00001164","icon":"$8f"},{"pid":2928,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 584 -p 8652 -ip 8652","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00002928","icon":"$90"},{"pid":8180,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 584 -p 8304 -ip 8304","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00008180","icon":"$91"},{"pid":5316,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 580 -p 2360 -ip 2360","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00005316","icon":"$92"},{"pid":7672,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 576 -p 6104 -ip 6104","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007672","icon":"$93"},{"pid":8348,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 612 -p 8300 -ip 8300","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00008348","icon":"$94"},{"pid":4136,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 612 -p 8104 -ip 8104","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00004136","icon":"$95"},{"pid":2772,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 572 -p 8344 -ip 8344","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00002772","icon":"$96"},{"pid":6684,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 544 -p 8220 -ip 8220","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00006684","icon":"$97"},{"pid":5864,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 544 -p 3412 -ip 3412","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00005864","icon":"$98"},{"pid":768,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 544 -p 436 -ip 436","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00000768","icon":"$99"}],"all_imported_dlls":["winnsi.dll","Windows.Security.Authentication.Web.Core.dll","user32.dll","dwmapi.dll","DWrite.dll","msasn1.dll","webio.dll","mswsock.dll","CoreMessaging.dll","vcruntime140_1.dll","oneauth.dll","KernelBase.dll","TextInputFramework.dll","Windows.UI.dll","cfgmgr32.dll","msvcp_win.dll","uxtheme.dll","telclient.dll","CapabilityAccessManagerClient.dll","UserMgrProxy.dll","kernel.appcore.dll","edputil.dll","rasadhlp.dll","wtsapi32.dll","oleacc.dll","aadWamExtension.dll","netprofm.dll","propsys.dll","dhcpcsvc.dll","profapi.dll","InputHost.dll","MicrosoftAccountWAMExtension.dll","dbghelp.dll","winsta.dll","webauthn.dll","winmm.dll","Windows.UI.Immersive.dll","powrprof.dll","cryptbase.dll","VxSSL64.dll","dpapi.dll","Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll","Windows.Security.Authentication.OnlineId.dll","psapi.dll","rpcrt4.dll","gdi32full.dll","KBDUS.DLL","gpapi.dll","nsi.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","wkscli.dll","bcrypt.dll","ole32.dll","nlansp_c.dll","kernel32.dll","netapi32.dll","usermgrcli.dll","sspicli.dll","OnDemandConnRouteHelper.dll","DataExchange.dll","windows.storage.dll","GdiPlus.dll","WinTypes.dll","netutils.dll","atlthunk.dll","ntdll.dll","ws2_32.dll","sechost.dll","comctl32.dll","version.dll","vcruntime140.dll","CorePrivacySettingsStore.dll","iertutil.dll","CoreUIComponents.dll","policymanager.dll","msvcp110_win.dll","FlightSettings.dll","bcryptprimitives.dll","fcon.dll","Windows.Web.dll","dnsapi.dll","mdmregistration.dll","secur32.dll","ffmpeg.dll","shlwapi.dll","msvcp140.dll","ntmarta.dll","twinapi.appcore.dll","dbgcore.dll","verifier.dll","ucrtbase.dll","imm32.dll","fltLib.dll","dsreg.dll","crypt32.dll","setupapi.dll","shell32.dll","SHCore.dll","devobj.dll","combase.dll","EmbeddedBrowserWebView.dll","gdi32.dll","advapi32.dll","msvcrt.dll","dhcpcsvc6.dll","msedge_elf.dll","samcli.dll","wldp.dll","rsaenh.dll","msedge.dll","wintrust.dll","OneCoreCommonProxyStub.dll","vaultcli.dll","microsoft_shell_integration.dll","OneCoreUAPCommonProxyStub.dll","FWPUCLNT.DLL","npmproxy.dll","oleaut32.dll","clbcatq.dll","TextShaping.dll","DiagnosticDataSettings.dll","win32u.dll","IPHLPAPI.DLL","cryptsp.dll","userenv.dll","mscms.dll","winhttp.dll","umpdc.dll","msctf.dll","directmanipulation.dll","omadmapi.dll","oneds.dll","Windows.StateRepositoryCore.dll","schannel.dll","tbs.dll","dmcmnutils.dll","srvcli.dll","dxgi.dll","d3d11.dll","dcomp.dll","ntasn1.dll","ncrypt.dll","mskeyprotect.dll","twinapi.dll","ncryptsslp.dll","nlaapi.dll","coloradapterclient.dll","imagehlp.dll","WindowManagementAPI.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"281cd09e94508c36553f4ee5ca46bdd20bcbe6d9fc91a091b4a60688964c4386","sha256":"281cd09e94508c36553f4ee5ca46bdd20bcbe6d9fc91a091b4a60688964c4386","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"data_1","sha256":"b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"metadata","sha256":"07a486481337b6b8670db113207cfe2547929490e12951ca9e59f21c549919cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"0b50d14e-6713-41f2-9197-30ff6ff07a80.dmp","sha256":"e5ad462dfdd2f3aefb677c43036c47a4408521c246849c815dba70820c68625e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"settings.dat","sha256":"a751c8b004feb14257c17fda3964df1ea376ae0750ec7dabaabb93509d4d4b71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"throttle_store.dat","sha256":"41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"watson_metadata","sha256":"05a640fdab2f0d4975df593177eccb89d6b5251b0c44361f190dd0fa98d01102","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"2c9bf446-8dab-4854-ae9f-7e4c49574432.tmp","sha256":"00f3a870088e1d0ede48b1a7a82af8bf30aadb59d2a1f12d721a5b79c174a66d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"88530ea3-1d84-4492-86a8-4bd30e6eebc4.tmp","sha256":"e60cf58cb57f13f157848d957bb46ba5925845ecfd3ecff2c7babf9df81421aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"1afe9cacc9803fd2_0","sha256":"953e1666b233347072cd57d586c7138f8015752bafee76be1a14b1c8b93e58ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"d73c28ba6a34bf0e_0","sha256":"d8e811ba103c6a039e00f55bb76fc084431977532dc261a709a72473d301da83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"index","sha256":"fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"temp-index","sha256":"b9dcfd31bc7c89948790a8bec55f3e39c3225cc34e89da2398fc7e6903e0c743","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"data_0","sha256":"d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"data_2","sha256":"ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"data_3","sha256":"e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"308dd6b1-53c5-4bc7-843d-34e4cb420cf3.tmp","sha256":"e05c77c1dffd521beaa87ae2ee5d3a169e925bbabb7efd15a813fa0507e5a3c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"3f4ca32c-3fb3-4286-89c4-58c41af7bbc4.tmp","sha256":"35b617fb3c6495ba0ac4eca009b271c34e842b347ba8a45c6d7b71d414a03eea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"4e7b31e3-0803-4f88-9668-125da0d2671e.tmp","sha256":"1f72f7e2611749659563cc227a1c71888944b213a23581966188483fb9e31cba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"5867338e-214c-4a3b-9a29-3e41826787bb.tmp","sha256":"a273b19c8d96d0cc62200a829a22f88c3f08f64a6f0bb4597c8915e40ab68aef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"73f1e785-0b80-4d26-80b7-bf9a56dcc3bf.tmp","sha256":"553b2137cbddfa83806636dea3f68872957e38bea50a6716fbd8ab6b38b09b22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"d442bc50-d993-4a07-8382-0956ddbedd0e.dmp","sha256":"aa05b23aa39cdef7caa2534cb1b4f5dcb479485b7baf9b758ab3479baff0c1c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"27361e53-eda8-4e4c-a80c-a554ebd34419.tmp","sha256":"b51b5089f5c767ff2a89608caa9c9a9e44ce3aca34e9c29677d59e39c272c14c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"347ea525-da2b-4b8f-b78c-73af1e52ff7e.tmp","sha256":"d1d625ca52cf7ab50f331b3878f1989a2eef9f6d4dfdd5f0129e16367d0e2787","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"77e13626-bcff-4bd9-aafa-c64802f5827e.tmp","sha256":"8428e477566587d745da61d14df52ec7575ef0fe49ea2025374340afec3a51d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Crashpad\\throttle_store.dat","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Crashpad\\settings.dat","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\crashpad_6572_OLYRXJHCMVDTQARA","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\BrowserMetrics\\BrowserMetrics-6AD17A94-19AC.pma","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\lockfile","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Variations","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Edge-Local-State-Tmp-eccaa385-d549-424a-8f96-148c3e2a2bbf.tmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.6572.7708.4810844203598286688","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\ShaderCache\\index","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\ShaderCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\ShaderCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\ShaderCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\ShaderCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"pipe\\LOCAL\\mojo.6572.7708.4276572512845905110","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Last Version","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\README","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Edge-Local-State-Tmp-76b2d190-3d46-44f3-8d93-867ffcceb31c.tmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Local State~RF489c9f.TMP","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.6572.7708.4994826369324680207","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\History","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\ServerCertificate","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\History-journal","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\ServerCertificate-journal","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Web Data","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Web Data-journal","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Vpn Tokens","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Vpn Tokens-journal","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Code Cache\\js\\index","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Code Cache\\wasm\\index","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Code Cache\\js\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Code Cache\\wasm\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Network\\NetworkDataMigrated","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Favicons","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Favicons-journal","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\ClientCertificates\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\ClientCertificates\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Login Data For Account","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Login Data For Account-journal","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Site Characteristics Database\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Site Characteristics Database\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Login Data","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Sync Data\\LevelDB\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Login Data-journal","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Sync Data\\LevelDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Site Characteristics Database\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\discounts_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\discounts_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Sync Data\\LevelDB\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\commerce_subscription_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\discount_infos_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Sync Data\\LevelDB\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\commerce_subscription_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\parcel_tracking_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\PersistentOriginTrials\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\PersistentOriginTrials\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\discount_infos_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Site Characteristics Database\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Extension Rules\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.7816.6780.1729321346947612973","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Edge-Local-State-Tmp-e1f00d4e-7ae9-4f3d-a4cd-140e666908e0.tmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\parcel_tracking_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Extension Rules\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Local State~RF48a9af.TMP","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Extension Rules\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Edge-Local-State-Tmp-369a3029-f5b9-4c81-8c01-7f9f0918b57a.tmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Local State~RF48a9ed.TMP","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Extension Rules\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\SharedStorage","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\SharedStorage-journal","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\SharedStorage-wal","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\shared_proto_db\\metadata\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\shared_proto_db\\metadata\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\shared_proto_db\\metadata\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Safe Browsing Network\\NetworkDataMigrated","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\shared_proto_db\\metadata\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\GPUCache\\index","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.6572.7708.1363261215309360668","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\GPUCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\GPUCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\GPUCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\GPUCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\DawnWebGPUCache\\index","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\DawnWebGPUCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\DawnWebGPUCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\DawnWebGPUCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\DawnWebGPUCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\DawnGraphiteCache\\index","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\DawnGraphiteCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\DawnGraphiteCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\DawnGraphiteCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\DawnGraphiteCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.6572.7708.7266940371857713136","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%TEMP%\\0c506da8-58aa-4a96-91fc-9973447a5021.tmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.6572.1248.5857634567649105635","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.6572.7708.7332143404941688200","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Sync Data\\LevelDB\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Extension Rules\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\shared_proto_db\\metadata\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Site Characteristics Database\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\component_crx_cache\\7aa00a64-f88b-4edf-a0f8-8cbee0b3943b.tmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.6572.1248.17740997744935710551","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\shared_proto_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\shared_proto_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\shared_proto_db\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\shared_proto_db\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Code Cache\\js\\1afe9cacc9803fd2_0","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\shared_proto_db\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Extension Scripts\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Extension Scripts\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Extension Scripts\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Extension Scripts\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Extension Scripts\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\88530ea3-1d84-4492-86a8-4bd30e6eebc4.tmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\2c9bf446-8dab-4854-ae9f-7e4c49574432.tmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\TokenBroker\\Cache\\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\TokenBroker\\Cache\\8ae9f0c30ea1668425d0f7d6255d597ead710776.tbres","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Extension State\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Extension State\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Extension State\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Extension State\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.6572.7708.3655925749260754756","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Extension State\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.6572.7708.9567585410654261130","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Code Cache\\js\\d73c28ba6a34bf0e_0","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Edge-Local-State-Tmp-adafb66e-97fc-46ec-bc9e-befcace80994.tmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Local State~RF48d3bc.TMP","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.6572.7708.14104115865010445203","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.6572.7708.13303763013417386879","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.6572.7708.9040517434856774139","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.6572.7708.1439525111887083810","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\e3ebe5a9-8d85-498d-a904-39eb1d2ef440.tmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Preferences~RF48f83c.TMP","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.6572.7708.8787016575173890883","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.6572.7708.9217770952825902347","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Code Cache\\js\\index-dir\\the-real-index~RF491ae7.TMP","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Crashpad","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Crashpad\\reports","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Crashpad\\attachments","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Crashpad\\metadata","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Crashpad\\temp\\edge_shutdown_crash.txt","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Crashpad\\reports\\0b50d14e-6713-41f2-9197-30ff6ff07a80.dmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Crashpad\\watson_metadata","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Shared Dictionary\\cache\\index","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Shared Dictionary\\db","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Shared Dictionary\\db-journal","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Network\\Trust Tokens","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Network\\Trust Tokens-journal","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Shared Dictionary\\cache\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Safe Browsing Network\\Safe Browsing Cookies","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Safe Browsing Network\\Safe Browsing Cookies-journal","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Network\\Cookies","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Network\\Cookies-journal","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Network\\7c456974-d527-4809-864e-b2e9e99f2498.tmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Network\\Reporting and NEL","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Network\\Reporting and NEL-journal","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Network\\f1caf4f4-221e-4889-bac5-5b752a534b09.tmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Network\\SCT Auditing Pending Reports~RF48cf77.TMP","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Network\\57028a7a-a954-4ead-8cfd-b879b45ae314.tmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Network\\SCT Auditing Pending Reports~RF48cf86.TMP","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Network\\e79ff55a-db59-495f-abe8-dd02900ec933.tmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"%APPDATA%\\7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2.exe\\EBWebView\\Default\\Network\\483c491c-cc61-4bd9-a4da-ccaba1cad878.tmp","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"pipe\\LOCAL\\mojo.2160.2652.13889861785494203091","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"pipe\\crashpad_8292_GELFRPJOZPSXYTAR","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Crashpad\\throttle_store.dat","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Crashpad\\settings.dat","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\BrowserMetrics\\BrowserMetrics-6AE1AF77-2064.pma","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\lockfile","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Variations","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\4e7b31e3-0803-4f88-9668-125da0d2671e.tmp","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"pipe\\LOCAL\\mojo.8292.8384.3865069968869345665","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\ShaderCache\\index","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\ShaderCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\ShaderCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\ShaderCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\ShaderCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"pipe\\LOCAL\\mojo.8292.8384.9810611423517675978","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Last Version","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\README","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"pipe\\LOCAL\\mojo.8292.8384.1952335504889998382","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\ServerCertificate","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\ServerCertificate-journal","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Vpn Tokens","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\History","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Web Data","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Web Data-journal","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Sync Data\\LevelDB\\LOG","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Sync Data\\LevelDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Vpn Tokens-journal","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Sync Data\\LevelDB\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Sync Data\\LevelDB\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Network\\NetworkDataMigrated","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"pipe\\LOCAL\\mojo.5860.4284.8352252828937570342","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\History-journal","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Site Characteristics Database\\LOG","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Site Characteristics Database\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Site Characteristics Database\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Site Characteristics Database\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Favicons","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Favicons-journal","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Safe Browsing Network\\NetworkDataMigrated","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\ClientCertificates\\LOG","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\ClientCertificates\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\PersistentOriginTrials\\LOG","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\PersistentOriginTrials\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Login Data For Account","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Login Data","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Login Data For Account-journal","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Login Data-journal","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Extension Rules\\LOG","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Extension Rules\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Extension Rules\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Extension Rules\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\3f4ca32c-3fb3-4286-89c4-58c41af7bbc4.tmp","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Local State~RF1d9d5c.TMP","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\73f1e785-0b80-4d26-80b7-bf9a56dcc3bf.tmp","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Local State~RF1d9d9a.TMP","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\parcel_tracking_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\parcel_tracking_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\discount_infos_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\discount_infos_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\discounts_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\discounts_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\commerce_subscription_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\commerce_subscription_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\LOG","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Code Cache","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Code Cache\\js\\index","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Code Cache\\wasm\\index","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Code Cache\\js\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Code Cache\\wasm\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\SharedStorage","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\shared_proto_db\\metadata\\LOG","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\shared_proto_db\\metadata\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\shared_proto_db\\metadata\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\SharedStorage-journal","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\shared_proto_db\\metadata\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\SharedStorage-wal","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Sync Data\\LevelDB\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Extension Rules\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Site Characteristics Database\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\shared_proto_db\\metadata\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Extension Scripts\\LOG","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Extension Scripts\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Extension Scripts\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Extension Scripts\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\shared_proto_db\\LOG","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\shared_proto_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\shared_proto_db\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Extension Scripts\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\shared_proto_db\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"pipe\\LOCAL\\mojo.8292.8384.15911120394161480496","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\GPUCache\\index","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\GPUCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\GPUCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\GPUCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\GPUCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\DawnWebGPUCache\\index","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\DawnWebGPUCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\DawnWebGPUCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\DawnWebGPUCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\DawnWebGPUCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\DawnGraphiteCache\\index","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"pipe\\LOCAL\\mojo.8292.8384.17703552306531469255","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\DawnGraphiteCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\DawnGraphiteCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\DawnGraphiteCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\DawnGraphiteCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\shared_proto_db\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Extension State\\LOG","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Extension State\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Extension State\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Extension State\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Crashpad","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Crashpad\\reports","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Crashpad\\attachments","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Crashpad\\metadata","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Crashpad\\temp\\edge_shutdown_crash.txt","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Crashpad\\reports\\d442bc50-d993-4a07-8382-0956ddbedd0e.dmp","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Shared Dictionary\\cache\\index","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Shared Dictionary\\db","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Shared Dictionary\\db-journal","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Network\\Trust Tokens","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Network\\Trust Tokens-journal","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Shared Dictionary\\cache\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Safe Browsing Network\\Safe Browsing Cookies","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Safe Browsing Network\\Safe Browsing Cookies-journal","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Network\\Reporting and NEL","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Network\\Reporting and NEL-journal","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Network\\Cookies","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Network\\Cookies-journal","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Network\\c8b4fd68-6501-4d83-a8b5-610287dffd3f.tmp","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Network\\cf2a85bd-fc32-430d-b5d8-81b9fcbfcc06.tmp","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Network\\SCT Auditing Pending Reports~RF1dbd48.TMP","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Network\\ddfe5daf-c37a-4115-b5b8-70f9645931ff.tmp","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"path":"%APPDATA%\\RDPOfficeXManager.exe\\EBWebView\\Default\\Network\\f37c16a2-7dda-4655-8a4d-3a1beb2405df.tmp","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\\CLOCKDATA\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\\IMMERSIVE\\PRODUCTION\\PROPERTY\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\\IMMERSIVE\\PRODUCTION\\TOKEN\\{67082621-8D18-4333-9C64-10DE93676363}\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\STORE\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\STORE\\ALLOWTELEMETRY\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DEVICEACCESS\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\EDITION\\DEVICEPOLICY\\ALLOWTELEMETRY\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\DEVICEPOLICY\\ALLOWTELEMETRY\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\DEVICEPOLICY\\ALLOWTELEMETRY\\\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\DATACOLLECTION\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"key":"HKCUHKCU\\\\","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0001\\","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGEWEBVIEW\\PREFERENCEMACS\\DEFAULT\\EXTENSIONS.SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGEWEBVIEW\\PREFERENCEMACS\\DEFAULT\\EXTENSIONS.SETTINGS\\EXTENSIONS.SETTINGS","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7816:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"Local\\SM0:7816:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"Local\\SM0:7816:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:7816:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:7816:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"wails-app-7a8cf666-2335-4eb8-a653-13bd1df9a48dsim","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7816:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\wails-app-7a8cf666-2335-4eb8-a653-13bd1df9a48dsim","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7816:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7816:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6572:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"Local\\SM0:6572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"Local\\SM0:6572:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:6572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:6572:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"},{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6572:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:7364:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"Local\\SM0:7364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:7364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7364:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1340:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1340:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:1340:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"Local\\SM0:1340:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6372:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:6372:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:6372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"Local\\SM0:6372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:7836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2160:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:2160:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7504:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7504:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"Local\\SM0:7504:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:7504:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7116:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:7116:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8056:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"Local\\SM0:8056:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:5572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2544:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2544:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:2544:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"Local\\SM0:2544:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:5016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:6288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"Local\\SM0:6288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4380:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:4380:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7660:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7660:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"Local\\SM0:7660:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:7660:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"SM0:2008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad1756cef99abc0680d0b67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5860:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"Local\\SM0:5860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:5860:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:5860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8292:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"Local\\SM0:8292:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:8292:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:8292:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8292:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8292:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"Local\\SM0:8700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:8700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:8700:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8700:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6204:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:6204:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4004:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"Local\\SM0:4004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:4004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:4004:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6896:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:6896:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9048:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:9048:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8944:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:8944:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:1388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:8140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:6688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5268:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:5268:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8276:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:8276:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8652:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:8652:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:8304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:2360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:6104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:8300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:8104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8344:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:8344:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:8220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3412:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:3412:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]},{"name":"SM0:436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae1af535c480b9059079b91"}]}]}},"report_ids":{"sandbox_job_ids":["6ae1af535c480b9059079b91","6ad1756cef99abc0680d0b67"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 7169885e9230… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7169885e9230…. Malware family: Trojan.Generic. Threat score 100/100. 7/27 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 7169885e9230… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7169885e9230…. Malware family: Trojan.Generic. Threat score 100/100. 7/27 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7169885e9230836cf829ee86035864806a8720cb644e5a1d7f53f914b330cab2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 7169885e9230… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7169885e9230…. Malware family: Trojan.Generic. Threat score 100/100. 7/27 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L9a","11",{}]]