26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 7f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 80941f145866… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 80941f145866…. Malware family: Trojan.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 13 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/80941f145866655b28fb0a6baa2b6efebce45de9e564347515f7531e88b48d48","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","80941f145866655b28fb0a6baa2b6efebce45de9e564347515f7531e88b48d48"],"about":{"@type":"SoftwareApplication","name":"80941f145866655b28fb0a6baa2b6efebce45de9e564347515f7531e88b48d48.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"80941f145866655b28fb0a6baa2b6efebce45de9e564347515f7531e88b48d48","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T10e8,Found string "??\C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp, 00000000-00007172.00000001.227580.02BD0000.00000004.mdmp, 00000000-00007172.00000001.227580.02C70000.00000004.mdmp, 00000000-00007172.00000001.227580.07122000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp, 00000000-00007172.00000001.227580.02BD0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp, 00000000-00007172.00000000.226879.04A50000.00000004.mdmp, 00000000-00007172.00000001.227580.02BD0000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp, 00000000-00007172.00000000.226879.07122000.00000004.mdmp, 00000000-00007172.00000001.227580.07122000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp, 00000000-00007172.00000000.226879.07122000.00000004.mdmp, 00000000-00007172.00000001.227580.0880D000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp")28:T992,Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp")29:T4d6,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp")2a:T11e7,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject crash dump requested" (Indicator: "WaitForSingleObject"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject non-crash dump requested" (Indicator: "WaitForSingleObject"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject process end" (Indicator: "WaitForSingleObject"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp")2b:T926,Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp")2c:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp")2d:T748,"'sqlite_sequence' AND coalesce(rootpage,1)>0" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "select sql from "%w".sqlite_schema where type='table'and name<>'sqlite_sequence' and coalesce(rootpage,1)>0"), "SELECT sql FROM "%w".sqlite_schema WHERE type='index'" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "select sql from "%w".sqlite_schema where type='index'"), "SELECT'INSERT INTO %s.'||quote(name)||' SELECT*FROM"%w".'||quote(name)FROM %s.sqlite_schema WHERE type='table'AND coalesce(rootpage,1)>0" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "select'insert into %s.'||quote(name)||' select*from"%w".'||quote(name)from %s.sqlite_schema where type='table'and coalesce(rootpage,1)>0"), "INSERT INTO %s.sqlite_schema SELECT*FROM "%w".sqlite_schema WHERE type IN('view','trigger') OR(type='table'AND rootpage=0)" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "insert into %s.sqlite_schema select*from "%w".sqlite_schema where type in('view','trigger') or(type='table'and rootpage=0)"), "CREATE TABLE x" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "create table x"), "UPDATE %Q.sqlite_master SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "update %q.sqlite_master set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "CREATE TABLE %Q.sqlite_sequence(name,seq)" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "create table %q.sqlite_sequence(name,seq)"), "SELECT*FROM"%w"."%w"" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "select*from"%w"."%w""), "INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "insert into %q.sqlite_master values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "delete from %q.%s where %s=%q"), "DELETE FROM %Q.sqlite_sequence WHERE name=%Q" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "delete from %q.sqlite_sequence where name=%q"), "DELETE FROM %Q.sqlite_master WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "delete from %q.sqlite_master where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_master WHERE name=%Q AND type='trigger'" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "delete from %q.sqlite_master where name=%q and type='trigger'"), "UPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%d" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "update %q.sqlite_master set rootpage=%d where #%d and rootpage=#%d"), "DELETE FROM %Q.sqlite_master WHERE name=%Q AND type='index'" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "delete from %q.sqlite_master where name=%q and type='index'"), "SELECT*FROM"%w"" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "select*from"%w""), "INSERT INTO %Q.sqlite_master VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "insert into %q.sqlite_master values('trigger',%q,%q,0,'create trigger %q')"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, %d) WHERE (type!='index' OR tbl_name=%Q COLLATE nocase)AND name NOT LIKE 'sqliteX_%%' ESCAPE 'X'" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, %d) where (type!='index' or tbl_name=%q collate nocase)and name not like 'sqlitex_%%' escape 'x'"), "UPDATE %Q.sqlite_master SET tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "update %q.sqlite_master set tbl_name = %q name = case when type='table' then %q when name like 'sqlitex_autoindex%%' escape 'x' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q collate nocase and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "update "%w".sqlite_sequence set name = %q where name = %q"), "UPDATE sqlite_temp_schema SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, 1) tbl_name = CASE WHEN tbl_name=%Q COLLATE nocase AND sqlite_rename_test(%Q, sql, type, name, 1, 'after rename', 0) THEN %Q ELSE tbl_name END WHERE type IN ('view', 'trigger')" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "update sqlite_temp_schema set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, 1) tbl_name = case when tbl_name=%q collate nocase and sqlite_rename_test(%q, sql, type, name, 1, 'after rename', 0) then %q else tbl_name end where type in ('view', 'trigger')"), "SELECT 1 FROM "%w".sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, %d, %Q, %d)=NULL" (Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp, Indicator: "select 1 from "%w".sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, %d, %q, %d)=null")42:T407,Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "CreateDirectoryAndGetError" (Indicator: "CreateDirectory"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp")43:T479,Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "CreateFileW failed" (Indicator: "CreateFile"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "CreateFileVersionInfoWin" (Indicator: "CreateFile"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp")44:T528,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp")45:T8aa,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp")46:T280d,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 61083-159-0097D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 61083-194-00978190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 61083-194-00978190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 61083-194-00978190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 61083-196-0097BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 61083-207-00978AF0 "0}\software\microsoft\msbuild\4.0" in Source: 00000000-00004060.00000000.228376.19930000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004060.00000000.228376.9B9F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Google" in Source: 00000000-00004060.00000000.228376.9B9F0000.00000004.mdmp "Y\MACHINE\Software\Google\Update\ClientStateMedium\{8A69D345" in Source: 00000000-00004060.00000000.228376.9B9F0000.00000004.mdmp "e\Software\C" in Source: 00000000-00004060.00000000.228376.9B9F0000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-Bw" in Source: 00000000-00004060.00000000.228376.9B9F0000.00000004.mdmp "0}\software\microsoft\msbuild\4.0" in Source: 00000000-00004528.00000000.228113.90000000.00000004.mdmp 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp 00000000-00004528.00000001.228258.90000000.00000004.mdmp 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\StrongName\RevokedKeys" in Source: 00000000-00004528.00000000.228113.E91B0000.00000004.mdmp 00000000-00004528.00000001.228258.E91B0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463c-AFF1-A69D9E530F96}" in Source: 00000000-00004528.00000000.228113.E91B0000.00000004.mdmp 00000000-00004528.00000001.228258.E91B0000.00000004.mdmp "Y\MACHINE\Software\Google\Update\ClientStateMedium\{8A69D345-D564-463c-AFF1-A69D9E530F96}" in Source: 00000000-00004528.00000000.228113.E91B0000.00000004.mdmp 00000000-00004528.00000001.228258.E91B0000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004528.00000001.228258.12F88000.00000002.mdmp "HKLM\" in Source: 00000000-00004528.00000001.228258.12F88000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004528.00000001.228258.12F88000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004528.00000001.228258.12F88000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00004528.00000001.228258.12F88000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Google\Common" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Google" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Google\Update" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Classes\" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\EventLog\Application\" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Classes\CLSID\" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Microsoft\MediaPlayer\ShimInclusionList" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "SOFTWARE\Policies\Google\Chrome" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Google\Update\Clients\" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Google\Update\ClientState\" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Google\Update\ClientStateMedium\" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Clients\StartMenuInternet" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Classes" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\RegisteredApplications" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "SOFTWARE\" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "SOFTWARE\Policies\Google\Update" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Software\Google\Common\Rlz" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Failed to open registry key HKLM\" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "Failed to create/open registry key HKLM\" in Source: 00000000-00006788.00000000.228508.BDC12000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007172.00000000.226879.00971000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007172.00000000.226879.00971000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007172.00000000.226879.00971000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007172.00000000.226879.00971000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007172.00000000.226879.00971000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007172.00000000.226879.00971000.00000020.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007172.00000000.226879.02BD0000.00000004.mdmp 00000000-00007172.00000001.227580.02BD0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007172.00000000.226879.02BD0000.00000004.mdmp 00000000-00007172.00000001.227580.02BD0000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0" in Source: 00000000-00007172.00000000.226879.02BD0000.00000004.mdmp 00000000-00007172.00000001.227580.02BD0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007172.00000000.226879.04A50000.00000004.mdmp47:T926,Process HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Vary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-Site X-Content-Type-Options: nosniff x-cup-server-proof: 3046022100a75b48b51e45dcff42d0f6bf4136016f9a5e30223553a38c1c8e2d341cccbfd3022100c119e19439ea2432bd6a98ce184f71a4bb4bd208af6fc06de97d260f692835b6:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ETag: W/"3046022100a75b48b51e45dcff42d0f6bf4136016f9a5e30223553a38c1c8e2d341cccbfd3022100c119e19439ea2432bd6a98ce184f71a4bb4bd208af6fc06de97d260f692835b6:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" Cache-Control: no-cache no-store max-age=0 must-revalidate Pragma: no-cache Expires: Mon 01 Jan 1990 00:00:00 GMT Date: Sun 14 Jun 2026 15:57:42 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy: same-origin Content-Encoding: gzip Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN with response body ==>295D7D270A7B2263757272656E745F74696D655F6D696C6C6973223A313738313435323636323337332C227365727665725F6E6F6E6365223A312E3732373830....... "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1781452903&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiMzY1NjczNzA5NDY4NzU5MzgxOSIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: max-age=0 no-cache no-store must-revalidate Content-Length: 132 Content-Type: application/json; charset=utf-8 Content-Security-Policy: base-uri 'self';block-all-mixed-content;default-src 'self';img-src 'self';object-src 'none';script-src 'none';style-src 'self';upgrade-insecure-requests; X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 55904D9F17954C869FF027076E123591 Ref B: BY1AA1072315025 Ref C: 2026-06-14T15:58:01Z Date: Sun 14 Jun 2026 15:58:00 GMT with response body ==>7B2261737369676E6D656E74436F6E74657874223A223437444551706A38484253612B2F54496D572B354A4365755165526B6D354E4D704A575A473368537546....... "GET /lightning/api/v1/PageConfig?uiaVersion=1.1&trafficSource= HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive X-IsManagedDevice: false Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: max-age=0 no-cache no-store must-revalidate Content-Length: 51035 Content-Type: application/json; charset=utf-8 X-FALCON-REF: Ref A: 708C0575CA284315BC0A85CF438495AC Ref B: SC-WUS2-TKDUJ_AKS-GEN00-41973210-VMSS00000J_FABRICROUTER-AZUREGLOBALPRIVATE-7B6F57BCF4-5HKF6 Ref C: 2026-06-14T15:58:01Z X-Falcon-RouterStatusCode: SuccessfullyForwarded (200) X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 708C0575CA284315BC0A85CF438495AC Ref B: SJC211051203049 Ref C: 2026-06-14T15:58:01Z Date: Sun 14 Jun 2026 15:58:00 GMT with response body ==>7B2273686F756C64496D706F7274223A747275652C22696D706F727450617373776F7264223A747275652C22696E697469616C55726C223A2268747470733A2F....... "GET /serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.16299&devicefamily=desktop&installdate=1781452916&clientversion=145.0.3800.58&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 X-Client-Data: eyIxIjoiMCIsIjIiOiIwIiwiMyI6IjAiLCI0IjoiNzAyNjQ1NzEzNzA3MTA3MDY0OCIsIjYiOiJzdGFibGUiLCI5IjoiZGVza3RvcCJ9 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: max-age=0 no-cache no-store must-revalidate Content-Length: 132 Content-Type: application/json; charset=utf-8 Content-Security-Policy: base-uri 'self';block-all-mixed-content;default-src 'self';img-src 'self';object-src 'none';script-src 'none';style-src 'self';upgrade-insecure-requests; X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 0CD5E7555E0E498CA78719F313A40ED3 Ref B: BY1AA1072319031 Ref C: 2026-06-14T15:58:12Z Date: Sun 14 Jun 2026 15:58:12 GMT with response body ==>7B2261737369676E6D656E74436F6E74657874223A223437444551706A38484253612B2F54496D572B354A4365755165526B6D354E4D704A575A473368537546....... "GET /lightning/api/v1/PageConfig?uiaVersion=1.1&trafficSource= HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive X-IsManagedDevice: false Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: max-age=0 no-cache no-store must-revalidate Content-Length: 51035 Content-Type: application/json; charset=utf-8 X-FALCON-REF: Ref A: 34F363540D9244249CD421145E55F5CE Ref B: SC-WUS2-22BW6_AKS-GEN12-14445459-VMSS000004_FABRICROUTER-AZUREGLOBALPRIVATE-5F86685996-RP5RR Ref C: 2026-06-14T15:58:12Z X-Falcon-RouterStatusCode: SuccessfullyForwarded (200) X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 34F363540D9244249CD421145E55F5CE Ref B: SJC211051203047 Ref C: 2026-06-14T15:58:12Z Date: Sun 14 Jun 2026 15:58:12 GMT with response body ==>7B2273686F756C64496D706F7274223A747275652C22696D706F727450617373776F7264223A747275652C22696E697469616C55726C223A2268747470733A2F....... "GET /entityextractiontemplates/api/v1/assets/find-assets?name=edge_hub_apps_manifest_gz&version=4.11.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: public max-age=3600 Content-Length: 266 Content-Type: application/json; charset=utf-8 X-Cache: TCP_HIT X-Frame-Options: sameorigin X-MSEdge-Ref: Ref A: B06B47B32E0346C0B2F8ECE231738223 Ref B: BY1AA1072317036 Ref C: 2026-06-14T15:58:21Z Date: Sun 14 Jun 2026 15:58:20 GMT with response body ==>5B7B226E616D65223A22656467655F6875625F617070735F6D616E69666573745F677A222C2275726C223A2268747470733A2F2F656467656173736574736572....... "GET /entityextractiontemplates/api/v1/assets/find-assets?name=arbitration_priority_list&version=39.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: public max-age=3600 Content-Length: 271 Content-Type: application/json; charset=utf-8 X-Cache: TCP_HIT X-Frame-Options: sameorigin X-MSEdge-Ref: Ref A: B52BBD4780D347888C6C5421AB4C3DD4 Ref B: BY1AA1072319023 Ref C: 2026-06-14T15:58:21Z Date: Sun 14 Jun 2026 15:58:20 GMT with response body ==>5B7B226E616D65223A226172626974726174696F6E5F7072696F726974795F6C697374222C2275726C223A2268747470733A2F2F656467656173736574736572....... "GET /entityextractiontemplates/api/v1/assets/find-assets?name=domains_config_gz&version=3.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: public max-age=3600 Content-Length: 267 Content-Type: application/json; charset=utf-8 X-Cache: TCP_HIT X-Frame-Options: sameorigin X-MSEdge-Ref: Ref A: F8CAB93B67ED4D7CA478B53F68FA881B Ref B: BY1AA1072317036 Ref C: 2026-06-14T15:58:21Z Date: Sun 14 Jun 2026 15:58:20 GMT with response body ==>5B7B226E616D65223A22646F6D61696E735F636F6E6669675F677A222C2275726C223A2268747470733A2F2F656467656173736574736572766963652E617A75....... "GET /abusiveadblocking/api/v1/blocklist HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive If-None-Match: Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd" Response ==> HTTP/1.1 200 OK Cache-Control: public max-age=43200 Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Content-Encoding: gzip ETag: "5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B" Vary: Accept-Encoding X-Cache: TCP_HIT X-FALCON-REF: Ref A: B3ADCEC6477C4D9C84D1B846F8F22D49 Ref B: SC-WUS2-TKDUJ_AKS-GEN00-41973210-VMSS000009_FABRICROUTER-AZUREGLOBALPRIVATE-7B6F57BCF4-MCLF8 Ref C: 2026-06-14T12:48:56Z X-Falcon-RouterStatusCode: SuccessfullyForwarded (200) X-Mesh-Client-TTL: 72 Strict-Transport-Security: max-age=0 X-MSEdge-Ref: Ref A: D9B4EC1F51F042A5AE94CF92D6CA5A40 Ref B: BY1AA1072319042 Ref C: 2026-06-14T15:58:24Z Date: Sun 14 Jun 2026 15:58:23 GMT with response body ==>7B227369746573223A5B7B2275726C223A223234766964656F2E6265227D2C7B2275726C223A2237646E69667574626F6C2E6267227D2C7B2275726C223A2236....... "GET /time/1/current?cup2key=9:-yy59fPqe2WsPK-OxJtUSsroRTR7ux1ZiYYlCuPvuvg&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1 Host: clients2.google.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Vary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-Site X-Content-Type-Options: nosniff x-cup-server-proof: 3046022100cc9278aa7ad7ac5bfffbf37431b72b2fc6b39027fc43b2a5818aa1805b3ac3b4022100cde800e534da128cffeb5170b65c73fd4ff004d75701f3a0b761a89447635768:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ETag: W/"3046022100cc9278aa7ad7ac5bfffbf37431b72b2fc6b39027fc43b2a5818aa1805b3ac3b4022100cde800e534da128cffeb5170b65c73fd4ff004d75701f3a0b761a89447635768:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" Cache-Control: no-cache no-store max-age=0 must-revalidate Pragma: no-cache Expires: Mon 01 Jan 1990 00:00:00 GMT Date: Sun 14 Jun 2026 15:58:26 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy: same-origin Content-Encoding: gzip Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN with response body ==>295D7D270A7B2263757272656E745F74696D655F6D696C6C6973223A313738313435323730363336392C227365727665725F6E6F6E6365223A2D322E30393034....... "GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Sun 14 Jun 2026 15:58:36 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=l_ERF0pg02NBrHH49J3mg4m4c3DuBVCm9MLqBOGhJOI-1781452716.7774851-1.0.1.1-sYoDqvfHvmkpZu55Y44xLIjynEO1HXKrBuGfYjnxFCsydS.awxzcYUG7HfmLAOYhoQYA5sTCqXUHjr8Z6ept4M74N7NfosyXRYNd0CgssmmBJ6ZimVo7bFPmgnV8w.5A; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Sun 14 Jun 2026 16:28:36 GMT Server: cloudflare CF-RAY: a0ba8997db9c5e56-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2 Host: clientservices.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors If-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY= Sec-Fetch-Site: none A-Im: x-bm,gzip Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-gzip Date: Sun 14 Jun 2026 15:57:43 GMT X-Country: us Content-Security-Policy: sandbox allow-downloads allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-scripts allow-storage-access-by-user-activation allow-top-navigation allow-top-navigation-by-user-activation allow-top-navigation-to-custom-protocols Im: gzip X-Content-Type-Options: nosniff X-Xss-Protection: 0 X-Seed-Signature: MEUCIQCNwOksBDx8vUAYpJIhM9X3dT/PhGghrAMUp9APVyCTZAIgJcyJzZDhAvi2CeOU+xElIOKo+wExoCniVtm+1vb2aSI= X-Frame-Options: SAMEORIGIN Cross-Origin-Opener-Policy: same-origin X-Geo-Level-1: us-il Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: safebrowsingohttpgateway.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Ohttppublickey-Fst: true Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/ohttp-keys Date: Sun 14 Jun 2026 15:12:07 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Cache-Control: public max-age=3600 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 2736 with no response body "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-144.0.7559.133 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Sun 14 Jun 2026 15:57:43 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7104 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 32263 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /crx/blobs/AcPRoer2Zc8Cgsxh3W97Ool_-PGKhLaIiI3sel8eaYNhRISQxgF7RAU9V6yJvXw1e7sYHW2j6vqLEhEQKXjZoaglbnja3Q65AdkDVIKRv7wFMJgAqud8KltAaV-Hxvg30NwAxlKa5QTua4OZ5Ic-CUkgokgc_Nvmf1Of/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_107_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-chrome-extension X-Guploader-Uploadid: AJ5rDhHbqrieaejmuMkiiBmsvUKA1xeVaoLLZ0_GQMGUF4Umy6-LWrZ6C7rms3hA198SiIDJLfSTB9s Date: Sat 13 Jun 2026 18:35:02 GMT Server: UploadServer Last-Modified: Thu 11 Jun 2026 18:34:52 GMT Expires: Sun 13 Jun 2027 18:35:02 GMT Etag: 0613766b_b05dde31_e4e6f0e1_316fbea1_6bb6e3e5 Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 76963 X-Goog-Hash: crc32c=oht2/g== with response body ==>BINARY_CONTENT....... "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-145.0.3800.58 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Ms-Cv: pWvbSW0ZM2Mh7nUd7sLi6W Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Sun 14 Jun 2026 15:58:01 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7104 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 32281 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /b?rn=1781452912509&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=01BFDD232D5468A22ACACA5B2C37697D&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/2 Host: sb.scorecardresearch.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 302 Found Date: Sun 14 Jun 2026 15:58:06 GMT X-Amz-Cf-Pop: MSP50-P1 Set-Cookie: XID=154825cd41b12089063fb791781452686; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Location: /b2?rn=1781452912509&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=01BFDD232D5468A22ACACA5B2C37697D&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null X-Cache: Miss from cloudfront Accept-Ch: UA Platform Arch Model Mobile X-Amz-Cf-Id: X3xxsTtuzQMaq0XoRs2xiwp2GLWfowGLUNjlKJ68uuaXxFsddWPQVA== Via: 1.1 ed8b80e5737f346295d71c88336826b6.cloudfront.net (CloudFront) with no response body "GET /crx/blobs/AcPRoer2Zc8Cgsxh3W97Ool_-PGKhLaIiI3sel8eaYNhRISQxgF7RAU9V6yJvXw1e7sYHW2j6vqLEhEQKXjZoaglbnja3Q65AdkDVIKRv7wFMJgAqud8KltAaV-Hxvg30NwAxlKa5QTua4OZ5Ic-CUkgokgc_Nvmf1Of/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_107_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-chrome-extension X-Guploader-Uploadid: AJ5rDhHbqrieaejmuMkiiBmsvUKA1xeVaoLLZ0_GQMGUF4Umy6-LWrZ6C7rms3hA198SiIDJLfSTB9s Date: Sat 13 Jun 2026 18:35:02 GMT Server: UploadServer Last-Modified: Thu 11 Jun 2026 18:34:52 GMT Expires: Sun 13 Jun 2027 18:35:02 GMT Etag: 0613766b_b05dde31_e4e6f0e1_316fbea1_6bb6e3e5 Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 76986 X-Goog-Hash: crc32c=oht2/g== with response body ==>BINARY_CONTENT....... "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromiumcrx&prodchannel=&prodversion=145.0.3800.58&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-145.0.3800.58 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Ms-Cv: IeQESlufvhUnxULyX5GYmU Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Sun 14 Jun 2026 15:58:12 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7104 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 32292 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /b?rn=1781452923704&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=37B0C0C2BB9E6395161AD7BABA7A626F&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/2 Host: sb.scorecardresearch.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 302 Found Date: Sun 14 Jun 2026 15:58:18 GMT X-Amz-Cf-Pop: MSP50-P1 Set-Cookie: XID=1A3c05108539c978d4bbbbd1781452698; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Location: /b2?rn=1781452923704&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26feed_dis%3Dpeek%26en_widget_reg%3Dfalse%26startpage%3D1%26PC%3DU531%26firstlaunch%3D1%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=37B0C0C2BB9E6395161AD7BABA7A626F&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null X-Cache: Miss from cloudfront Accept-Ch: UA Platform Arch Model Mobile X-Amz-Cf-Id: m4_cyvczbZPiByCfpUsFJgGuY6At84hvst3dErw53m7pZi6tpNG_Zw== Via: 1.1 ed8b80e5737f346295d71c88336826b6.cloudfront.net (CloudFront) with no response body "GET /crx/blobs/AcPRoer2Zc8Cgsxh3W97Ool_-PGKhLaIiI3sel8eaYNhRISQxgF7RAU9V6yJvXw1e7sYHW2j6vqLEhEQKXjZoaglbnja3Q65AdkDVIKRv7wFMJgAqud8KltAaV-Hxvg30NwAxlKa5QTua4OZ5Ic-CUkgokgc_Nvmf1Of/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_107_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-chrome-extension X-Guploader-Uploadid: AJ5rDhHbqrieaejmuMkiiBmsvUKA1xeVaoLLZ0_GQMGUF4Umy6-LWrZ6C7rms3hA198SiIDJLfSTB9s Date: Sat 13 Jun 2026 18:35:02 GMT Server: UploadServer Last-Modified: Thu 11 Jun 2026 18:34:52 GMT Expires: Sun 13 Jun 2027 18:35:02 GMT Etag: 0613766b_b05dde31_e4e6f0e1_316fbea1_6bb6e3e5 Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 76996 X-Goog-Hash: crc32c=oht2/g== with response body ==>BINARY_CONTENT....... "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2 Host: edgeassetservice.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/octet-stream Date: Sun 14 Jun 2026 15:58:21 GMT Last-Modified: Wed 08 Apr 2026 16:21:07 GMT X-Azure-Ref: 20260614T155821Z-1556c777655nk275hC1FTYt1bn000000110g000000000qxw X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Fd-Int-Roxy-Purgeid: 0 Vary: Accept-Encoding Content-Encoding: br X-Cache: TCP_HIT Cache-Control: public max-age=604800 X-Ms-Request-Id: 8ffad9c7-701e-0079-4ddf-f636e5000000 X-Ms-Blob-Type: BlockBlob with no response body "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: safebrowsingohttpgateway.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Ohttppublickey-Fst: true Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/ohttp-keys Date: Sun 14 Jun 2026 15:21:53 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Cache-Control: public max-age=3600 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 2193 with no response body "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2 Host: clientservices.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors If-None-Match: SMChYyMDI2MDEzMC0wMTAwMTEuMzU0MDAwEgYIABADIAA=#N/buIelIxNY= Sec-Fetch-Site: none A-Im: x-bm,gzip Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-gzip Date: Sun 14 Jun 2026 15:58:26 GMT X-Country: us Content-Security-Policy: sandbox allow-downloads allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-scripts allow-storage-access-by-user-activation allow-top-navigation allow-top-navigation-by-user-activation allow-top-navigation-to-custom-protocols Im: gzip X-Content-Type-Options: nosniff X-Xss-Protection: 0 X-Seed-Signature: MEUCIDnlNo4j7uBk69LnrHiQzdRhx3KJM5k2TCXTuxlh755PAiEA6g+gsPeEe+Mr/3xjxvmSpkzv6suPBmV22WCE30JdpYw= X-Frame-Options: SAMEORIGIN Cross-Origin-Opener-Policy: same-origin X-Geo-Level-1: us-il Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&prod=chromecrx&prodchannel=&prodversion=144.0.7559.133&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dinternal%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DHKFL%26ping%3Dr%253D-1%2526e%253D1 HTTP/2 Host: clients2.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Goog-Update-Appid: ghbmnnjooekpmoecnnnilnnbdlolhkhi,nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-144.0.7559.133 Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 X-Goog-Update-Interactivity: fg Priority: u=1, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: text/xml; charset=UTF-8 Date: Sun 14 Jun 2026 15:58:26 GMT Server: GSE Expires: Mon 01 Jan 1990 00:00:00 GMT X-Daynum: 7104 Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Pragma: no-cache X-Daystart: 32306 Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT.......4b:T4121,"http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0(]w%" - Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hd=xz" - Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found URL "http://www.microsoft.com0e'ugbi]]+q" - Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0b+[*k,ea$n'fuc4furl56bi=r%m-" - Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0(]w%" - Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hd=xz" - Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp") Found URL "http://www.microsoft.com0e'ugbi]]+q" - Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0b+[*k,ea$n'fuc4furl56bi=r%m-" - Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0(]w%" - Source: "00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hd=xz" - Source: "00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp") Found URL "http://www.microsoft.com0e'ugbi]]+q" - Source: "00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0b+[*k,ea$n'fuc4furl56bi=r%m-" - Source: "00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0(]w%" - Source: "00000000-00004528.00000001.228258.90000000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hd=xz" - Source: "00000000-00004528.00000001.228258.90000000.00000004.mdmp") Found URL "http://www.microsoft.com0e'ugbi]]+q" - Source: "00000000-00004528.00000001.228258.90000000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0b+[*k,ea$n'fuc4furl56bi=r%m-" - Source: "00000000-00004528.00000001.228258.90000000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004528.00000001.228258.90000000.00000004.mdmp") Found URL "https://support.google.com/chrome/?p=usage_stats_crash_reports" - Source: "00000000-00004528.00000001.228258.BDD37000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0(]w%" - Source: "00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hd=xz" - Source: "00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found URL "http://www.microsoft.com0e'ugbi]]+q" - Source: "00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0b+[*k,ea$n'fuc4furl56bi=r%m-" - Source: "00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found URL "https://clients2.google.com/cr/report" - Source: "00000000-00005060.00000001.228267.22AD0000.00000004.mdmp") Found URL "https://clients2.google.com/cr/report--annotation=channel=--annotation=plat=win64--annotation=prod=chrome--annotation=ver=144.0.7559.133--attachment=c:\program" - Source: "00000000-00005060.00000001.228267.22AD0000.00000004.mdmp") Found URL "https://clients2.google.com/cr/report" - Source: "00000000-00006788.00000000.228508.A42C0000.00000004.mdmp") Found URL "https://clients2.google.com/cr/report--annotation=channel=--annotation=plat=win64--annotation=prod=chrome--annotation=ver=144.0.7559.133--attachment=c:\program" - Source: "00000000-00006788.00000000.228508.A42C0000.00000004.mdmp") Found URL "https://support.google.com/chrome?p=chrome_uninstall_surveyopenroot\cimv2win32_processcreatecommandlinereturnvalueprocessidsoftware\microsoft\windows" - Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found URL "https://clients2.google.com/cr/reportcopyright" - Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance'>" - Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007172.00000000.226879.02A50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007172.00000000.226879.02A50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007172.00000000.226879.02A50000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ydigicert" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l250905/^g(o-cejy" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkd)miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=517145" - Source: "00000000-00007172.00000000.226879.07122000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00007172.00000000.226879.07122000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00007172.00000000.226879.07122000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00007172.00000000.226879.07122000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00007172.00000000.226879.07122000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00007172.00000000.226879.07122000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007172.00000000.226879.07122000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007172.00000000.226879.6F331000.00000020.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007172.00000001.227580.02BD0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007172.00000001.227580.02BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ydigicert" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ll*ir=qpt=qpt=qp=qp0905l*irl*irnbj'v(z0t(,l*irl*irl*irt[u0]" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkd)l*irl*irkwqgt1ass.washington1redmond1microsoft" - Source: "00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=517145" - Source: "00000000-00007172.00000001.227580.07122000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00007172.00000001.227580.07122000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00007172.00000001.227580.07122000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00007172.00000001.227580.07122000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00007172.00000001.227580.07122000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00007172.00000001.227580.07122000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007172.00000001.227580.07122000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007172.00000001.227580.07122000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0cryptsipverifyindirectdatacryptsipverifyindirectdataappxsipverifyindirectdataeappxsipverifyindirectdatacryptsipverifyindirectdatamsisipverifyindirectdatap7xsipverifyindirectdataappxbundlesipverifyindirectdatacryptsipverifyindirectdata1.3.6.1.4.1.311.21.2cryptsipverifyindirectdatacryptsipverifyindirectdata$%'%contextdllcreateobjectcontextschemedllretrieveencodedobjectwasyc" - Source: "00000000-00007172.00000001.227580.087B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007172.00000001.227580.087B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!qs[\l*ir8l*irpl*irl*irl*irpl*irl*ir0l*irs" - Source: "00000000-00007172.00000001.227580.087C2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00007172.00000001.227580.087C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00007172.00000001.227580.0880D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrmicrosoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenummapsreportingtypemicrosoft.powershell.cmdletization.generatedtypes.mppreferencevalue__disabledbasicadvancedsubmitsamplesconsenttypenonealwaysnevereverydaysundaymondaytuesdaywednesdaythursdayfridaysaturdayscantypequickscanfullscanscandirectionbothincomingoutcomingthreatseverityunknownmoderatehighseverethreatactioncleanquarantineremoveallowuserdefinednoactionblockpuaprotectiontypeenabledauditmodecloudblockleveltypedefaulthighpluszerotoleranceasrruleactiontypemicrosoft.powershell.cmdletization.generatedtypes.mpscancustomscanupdatesourcemicrosoft.powershell.cmdletization.generatedtypes.mpsignatureinternaldefinitionupdateservermicrosoftupdateservermmpcfileshares4[krm" - Source: "00000000-00007172.00000001.227580.0880D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/^g(o-cejy" - Source: "00000000-00007172.00000001.227580.0880D000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/cwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007172.00000001.227580.0880D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0r" (Indicator: "aes"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found string "AES-NI GCM module for x86_64, CRYPTOGAMS by " (Indicator: "aes"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found string "ChaCha20 for x86_64, CRYPTOGAMS by " (Indicator: "chacha"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found string "..\..\third_party\boringssl\src\crypto\ecdsa\ecdsa_asn1.cc" (Indicator: "ecdsa"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found string "..\..\third_party\boringssl\src\crypto\fipsmodule\ecdsa\ecdsa.cc.inc" (Indicator: "ecdsa"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found string "SignECDSA" (Indicator: "ecdsa"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00007172.00000000.226879.00971000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007172.00000000.226879.00971000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007172.00000000.226879.00971000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007172.00000000.226879.00971000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007172.00000000.226879.00971000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007172.00000000.226879.00971000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007172.00000000.226879.00971000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007172.00000000.226879.00971000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007172.00000000.226879.00971000.00000020.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp, 00000000-00007172.00000001.227580.02BD0000.00000004.mdmp, 00000000-00007172.00000001.227580.02C70000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp, 00000000-00007172.00000001.227580.02C70000.00000004.mdmp, 00000000-00007172.00000001.227580.07122000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp")6e:T657,file/memory contains long string with (Indicator: "ForEach-Object"; File: "m0omdbfoyqi.ps1") Found string "Select-Object" (Indicator: "Select-Object"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Measure-Object" (Indicator: "Measure-Object"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Compare-Object" (Indicator: "Compare-Object"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "ForEach-Object" (Indicator: "ForEach-Object"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Group-Object" (Indicator: "Group-Object"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Where-Object" (Indicator: "Where-Object"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -match '^Verbs.'} |" (Indicator: "Where-Object"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object @{" (Indicator: "Select-Object"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "$allVerbs | Microsoft.PowerShell.Core\Where-Object { $_.Verb -like $v }" (Indicator: "Where-Object"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Tee-Object" (Indicator: "Tee-Object"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp")6f:T113e,Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "NtQueryInformationProcess incorrect size" (Indicator: "QueryInformationProcess"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "::NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp")70:T151e,Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found reference to API "GetFileAttributesEx" (Indicator: "GetFileAttributes"; Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found reference to API "GetFileAttributesEx" (Indicator: "GetFileAttributes"; Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004528.00000001.228258.1D242000.00000002.mdmp") Found reference to API "Could not GetFileAttributes for" (Indicator: "GetFileAttributes"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetFileVersionInfo:" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp")71:Tc85,file/memory contains long string with (Indicator: "Get-Date"; File: "m0omdbfoyqi.ps1") Found string "Get-Command" (Indicator: "Get-Command"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-Help" (Indicator: "Get-Help"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-FormatData" (Indicator: "Get-FormatData"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-Module" (Indicator: "Get-Module"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-Variable" (Indicator: "Get-Variable"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-PSBreakpoint" (Indicator: "Get-PSBreakpoint"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-Content $file | more.com" (Indicator: "Get-Content"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-Verb" (Indicator: "Get-Verb"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "$null = Read-Host '" (Indicator: "Read-Host"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string ".FORWARDHELPTARGETNAME Get-Help" (Indicator: "Get-Help"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-Help @PSBoundParameters | more" (Indicator: "Get-Help"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Get-Member -type Properties -static |" (Indicator: "Get-Member"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "$null = Read-Host 'Press Enter to continue...'" (Indicator: "Read-Host"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-Alias" (Indicator: "Get-Alias"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-Content" (Indicator: "Get-Content"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-ChildItem" (Indicator: "Get-ChildItem"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-PSCallStack" (Indicator: "Get-PSCallStack"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-History" (Indicator: "Get-History"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-Location" (Indicator: "Get-Location"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-Member" (Indicator: "Get-Member"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-ItemProperty" (Indicator: "Get-ItemProperty"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-Service" (Indicator: "Get-Service"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Get-Unique" (Indicator: "Get-Unique"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp") Found string "Invoke-Item" (Indicator: "Invoke-Item"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp")72:T500,Found reference to API "GetEnvironmentVariable" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found reference to API "GetEnvironmentVariables" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004060.00000000.228376.19930000.00000004.mdmp") Found reference to API "GetEnvironmentVariable" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found reference to API "GetEnvironmentVariables" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp") Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "GetEnvironmentVariableW" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp")73:T812,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004060.00000000.228376.9B9F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Program Files\Google\Chrome\Application\144.0.7559.133\Installer\chrmstp.exe" (Indicator: "\Device\"; Source: "00000000-00004060.00000000.228376.9B9F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00004060.00000000.228376.9B9F0000.00000004.mdmp") Found string "\Program Files\Google\Chrome\Application\chrome.exeume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00004060.00000000.228376.9B9F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004528.00000000.228113.E91B0000.00000004.mdmp, 00000000-00004528.00000001.228258.E91B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004528.00000000.228113.E91B0000.00000004.mdmp, 00000000-00004528.00000001.228258.E91B0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005060.00000001.228267.22AD0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Program Files\Google\Chrome\Application\144.0.7559.133\Installer\chrmstp.exe" (Indicator: "\Device\"; Source: "00000000-00005060.00000001.228267.22AD0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006788.00000000.228508.A42C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Program Files\Google\Chrome\Application\144.0.7559.133\Installer\chrmstp.exe" (Indicator: "\Device\"; Source: "00000000-00006788.00000000.228508.A42C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007172.00000000.226879.02BD0000.00000004.mdmp, 00000000-00007172.00000001.227580.02BD0000.00000004.mdmp")74:T445,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "DeleteFileAfterReboot" (Indicator: "DeleteFile"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "DoDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "RemoveDirectory" (Indicator: "RemoveDirectory"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp")75:T4aa,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00007172.00000000.226879.04A50000.00000004.mdmp")76:T432,Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp")77:T100d,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00004528.00000001.228258.12F88000.00000002.mdmp") Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00006788.00000000.228508.BDC12000.00000002.mdmp")78:T8a5," "504F5354202F4C6973744163636F756E74733F67707369613D3126736F757263653D4368726F6D69756D42726F77736572266A736F6E3D7374616E64617264266C61663D62363462696E20485454502F320A486F73743A206163636F756E74732E676F6F676C652E636F6D0A557365722D4167656E743A204D6F7A696C6C612F352E30202857696E646F7773204E542031302E303B2057696E36343B2078363429204170706C655765624B69742F3533372E333620284B48544D4C2C206C696B65204765636B6F29204368726F6D652F3134342E302E302E30205361666172692F3533372E33360A436F6E74656E742D547970653A206170706C69636174696F6E2F782D7777772D666F726D2D75726C656E636F6465640A5365632D46657463682D4D6F64653A206E6F2D636F72730A5365632D46657463682D536974653A206E6F6E650A4163636570742D4C616E67756167653A20656E2D55532C656E3B713D302E390A4F726967696E3A2068747470733A2F2F7777772E676F6F676C652E636F6D0A5072696F726974793A20753D342C20690A4163636570742D456E636F64696E673A20677A69702C206465666C6174652C2062722C207A7374640A5365632D46657463682D446573743A20656D7074790A" HTTP/2 200 OK Content-Type: application/binary Date: Sun 14 Jun 2026 15:57:44 GMT Server: ESF Expires: Mon 01 Jan 1990 00:00:00 GMT Vary: Origin Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factors=* ch-ua-platform=* ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: https://www.google.com Reporting-Endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjUtHikmLw0ZBiOHxtB5Meyy0mIyDW1PNl0wVi84n-bNZALMTN8WPe7otsAh9u7xNQ0k3KL4zPTEnNK8ksqczJLC5JTE7OL80rKS5OLSpLLYo3MjAyMzAzMNczsIgvMAAAsx0fog" Access-Control-Allow-Credentials: true Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data:;report-uri /_/IdentityListAccountsHttp/cspreport/fine-allowlist X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with no response body "POST /v1:GetModels?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: optimizationguide-pa.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-protobuf Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Client-Data: CJS2yQEIorbJAQipncoBCISLywEIk6HLAQiFoM0B Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "n 2h atype.googleapis.com/google.privacy.webpermissionpredictions.v1.WebPermissionPredictionsClientInfo e 2_ Wtype.googleapis.com/google.internal.chrome.optimizationguide.v1.PageTopicsModelMetadata0 g 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ n 2h atype.googleapis.com/google.privacy.webpermissionpredictions.v1.WebPermissionPredictionsClientInfo g 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ g 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ l 2f `type.googleapis.com/google.internal.chrome.optimizationguide.v1.AutocompleteScoringModelMetadata g 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ + g- 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ g. 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ*en-US2" HTTP/2 200 OK Content-Type: application/x-protobuf Date: Sun 14 Jun 2026 15:57:50 GMT Server: ESF Content-Disposition: attachment X-Xss-Protection: 0 X-Content-Type-Options: nosniff Vary: Referer Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2 Host: accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Origin: https://www.google.com Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "504F5354202F4C6973744163636F756E74733F67707369613D3126736F757263653D4368726F6D69756D42726F77736572266A736F6E3D7374616E64617264266C61663D62363462696E20485454502F320A486F73743A206163636F756E74732E676F6F676C652E636F6D0A557365722D4167656E743A204D6F7A696C6C612F352E30202857696E646F7773204E542031302E303B2057696E36343B2078363429204170706C655765624B69742F3533372E333620284B48544D4C2C206C696B65204765636B6F29204368726F6D652F3134342E302E302E30205361666172692F3533372E33360A436F6E74656E742D547970653A206170706C69636174696F6E2F782D7777772D666F726D2D75726C656E636F6465640A5365632D46657463682D4D6F64653A206E6F2D636F72730A5365632D46657463682D536974653A206E6F6E650A4163636570742D4C616E67756167653A20656E2D55532C656E3B713D302E390A4F726967696E3A2068747470733A2F2F7777772E676F6F676C652E636F6D0A5072696F726974793A20753D342C20690A4163636570742D456E636F64696E673A20677A69702C206465666C6174652C2062722C207A7374640A5365632D46657463682D446573743A20656D7074790A" HTTP/2 200 OK Content-Type: application/binary Date: Sun 14 Jun 2026 15:58:26 GMT Server: ESF Expires: Mon 01 Jan 1990 00:00:00 GMT Vary: Origin Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factors=* ch-ua-platform=* ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: https://www.google.com Reporting-Endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzj0tHikmII0pBiOHxtB5Meyy0mIyDW1PNl0wVi84n-bNZAbBoSyOYMxEI8HIvm777IJtDwdN5hZiXdpPzC-MyU1LySzJLKnMziksTk5PzSvJLi4tSistSieCMDIzMDMwNzPQOL-AIDAHwMIVo" Access-Control-Allow-Credentials: true Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with no response body7c:T403,"\" (Indicator: \"SHA512\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007172.00000000.226879.02BD0000.00000004.mdmp, 00000000-00007172.00000001.227580.02C70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00004528.00000000.228113.E91B0000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00004528.00000000.228113.E91B0000.00000004.mdmp\n 00000000-00004528.00000001.228258.E91B0000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00007172.00000000.226879.02BD0000.00000004.mdmp\n 00000000-00007172.00000001.227580.02C70000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004060.00000000.228376.19930000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004528.00000000.228113.90000000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004528.00000001.228258.90000000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"chrmstp.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 2D9A0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2e","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00004528.00000001.228258.12F88000.00000002.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00004528.00000001.228258.12F88000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$30","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004528.00000000.228113.E91B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"Device trust key rotation failed. Could not send public key to DM server. HTTP Status:\" (Indicator: \"public key\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007172.00000000.226879.02BD0000.00000004.mdmp, 00000000-00007172.00000001.227580.02C70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.92925","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$31","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$32","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate available system drives (PowerShell command string)","description":"Found string \"Get-PSDrive\" (Indicator: \"Get-PSDrive\"; Source: \"00000000-00007172.00000000.226879.04A50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":1,"id":"string-997","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005316-00000C2B-2478541687\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005316-00000C2B-2482633442\")\n Found reference to API \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found reference to API \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetImpersonationUserName\" (Source: \"00000000-00004060.00000000.228376.19930000.00000004.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00004060.00000000.228376.19930000.00000004.mdmp\")\n Found string \"GetImpersonationUserName\" (Source: \"00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00004528.00000000.228113.E91B0000.00000004.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005316-00000C2B-2478541687\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005316-00000C2B-2482633442\")\n Found string \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found string \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005316-00000C2B-2478837807\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain instances of WMI classes using PowerShell","description":"Found string \"Get-WmiObject\" (Source: \"00000000-00007172.00000000.226879.04A50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-696","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004528.00000001.228258.12F88000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (Source: \"00000000-00004528.00000001.228258.12F88000.00000002.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00004528.00000001.228258.12F88000.00000002.mdmp\")\n Found string \"QueryServiceConfig failed\" (Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found string \"QueryServiceConfig\" (Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found string \"QueryServiceConfig2\" (Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found reference to API \"GetDateFormat\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004528.00000001.228258.12F88000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00005316-00000C2B-2482635819\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00005316-00000C2B-2482635842\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00007172-00000C2B-2486795122\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00007172-00000C2B-2486795145\")\n Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"x6A-\"\n \"i&`{ZjWzu\"\n \"QjPZrH+\"\n \"z|\"v\", \"t@Dy@@n\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$67","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"clientservices.googleapis.com\" has high entropy\n Contacted domain: \"safebrowsingohttpgateway.googleapis.com\" has high entropy\n Contacted domain: \"clients2.googleusercontent.com\" has high entropy\n Contacted domain: \"android.clients.google.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$68","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"accounts.google.com\" (83 days old)\n Short term registered certificate: \"clients2.google.com\" (83 days old)\n Short term registered certificate: \"clients2.googleusercontent.com\" (83 days old)\n Short term registered certificate: \"clientservices.googleapis.com\" (83 days old)\n Short term registered certificate: \"optimizationguide-pa.googleapis.com\" (83 days old)\n Short term registered certificate: \"safebrowsingohttpgateway.googleapis.com\" (83 days old)\n Short term registered certificate: \"www.google.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"142.251.152.119\" on port \"443\"\n HTTPS traffic to \"142.250.177.238\" on port \"443\"\n HTTPS traffic to \"142.251.163.84\" on port \"443\"\n HTTPS traffic to \"216.239.32.223\" on port \"443\"\n HTTPS traffic to \"142.251.210.206\" on port \"443\"\n HTTPS traffic to \"142.250.177.225\" on port \"443\"\n HTTPS traffic to \"216.239.36.223\" on port \"443\"\n HTTPS traffic to \"18.160.102.123\" on port \"443\"\n HTTPS traffic to \"150.171.22.17\" on port \"443\"\n HTTPS traffic to \"4.152.199.46\" on port \"443\"\n HTTPS traffic to \"150.171.109.74\" on port \"443\"\n HTTPS traffic to \"150.171.109.71\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on process \"00000000-00004060\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00004528\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – high entropy image embedded in .NET resource","description":"YARA signature for high entropy images embedded in resource file \"sample.bin\"\n YARA signature for high entropy images embedded in resource file \"ahnmzmQLhJDRg.exe.899636397\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-214","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \"System.Runtime.Remoting\" (Source: \"00000000-00004060.00000000.228376.19930000.00000004.mdmp\")\n Found string \"System.Runtime.Remoting\" (Source: \"00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to receive remote commands (Powershell command string)","description":"Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00007172.00000000.226879.04A50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-289","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Remote Access Related","name":"Contains reference to remote powershell session activity (Powershell command string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1021.006","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00004060.00000000.228376.9B9F0000.00000004.mdmp\")\n Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004528.00000001.228258.12F88000.00000002.mdmp\")\n Found string \"+ncalrpc:[OLEE8C314639E5BA0D1442CC7FD3BA5]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007172.00000000.226879.02BD0000.00000004.mdmp, 00000000-00007172.00000001.227580.02BD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00007172.00000000.226879.02BD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\b552exty.kby\"\" (Indicator: \"--user-data-dir\"; File: \"chrome.exe\")\n file/memory contains long string with (Indicator: \"--user-data-dir\"; File: \"chrome.exe\")\n Found string \"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"%TEMP%\\ditzodm4.uhs\"\" (Indicator: \"--user-data-dir\"; File: \"msedge.exe\")\n file/memory contains long string with (Indicator: \"--user-data-dir\"; File: \"msedge.exe\")","origin":"File/Memory","mitre_attack_id":"T1550.004","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004528.00000001.228258.12F88000.00000002.mdmp, 00000000-00004528.00000001.228258.1D242000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006788.00000000.228508.BDC12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00004060.00000000.228376.19930000.00000004.mdmp\")\n Found string \"GetProcessById\" (Source: \"00000000-00004528.00000000.228113.90000000.00000004.mdmp, 00000000-00004528.00000000.228113.EB9B0000.00000004.mdmp, 00000000-00004528.00000001.228258.90000000.00000004.mdmp, 00000000-00004528.00000001.228258.EB9B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve security-related event logs (PowerShell command string)","description":"Found string \"PowerShell -Command {Get-EventLog -LogName security}\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00007172.00000000.226879.04A50000.00000004.mdmp\")\n Found string \"PowerShell -Command \"& {Get-EventLog -LogName security}\"\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00007172.00000000.226879.04A50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1654","relevance":1,"id":"string-647","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$6c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a2ecf4c8cbcfa593407faf4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"