26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 47:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T42c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 009192a8e02b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 009192a8e02b…. Threat score 100/100. 0/24 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe"],"about":{"@type":"SoftwareApplication","name":"MARS n_2026_15_Saison IRA 2026-27.pdf","applicationCategory":["pdf"],"identifier":"009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":4,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T77b,"identity_helper.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001120) "identity_helper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001120) "identity_helper.exe" called "RtlGetVersion" with parameter 240100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001120)28:T7a2,"identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001120) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001120) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00001120) "identity_helper.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00001120) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001120) "identity_helper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001120) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001120) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001120) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001120) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00001120) "identity_helper.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Edge\Application\145.0.3800.58\msedge.dll (UID: 00000000-00001120) "identity_helper.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001120) "identity_helper.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001120) "identity_helper.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001120) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001120) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001120) "identity_helper.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001120)29:T18b3,"identity_helper.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter RtlGetDeviceFamilyInfoEnum (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter PrefetchVirtualMemory (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter ChromeMain (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsGetStringRawBuffer (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001120) "identity_helper.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001120)2a:T1e24,Object ID 4 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 841.92 re W* n BT /F1 12 Tf 1 0 0 1 45 717.22 Tm /GS7 gs 0 g /GS8 gs 0 G [( )] TJ ET Q q 0.000008871 0 595.32 841.92 re W* n Q q 28.5 726.44 213.4 103.28 r ... Object ID 45 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 841.92 re W* n BT /F1 12 Tf 1 0 0 1 71.424 795.24 Tm /GS7 gs 0 g /GS8 gs 0 G [( )] TJ ET Q q 0.000008871 0 595.32 841.92 re W* n Q q 19.5 726.44 213.4 103. ... Object ID 70 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 841.92 re W* n BT /F1 12 Tf 1 0 0 1 71.424 795.24 Tm /GS7 gs 0 g /GS8 gs 0 G [( )] TJ ET Q q 0.000008871 0 595.32 841.92 re W* n Q q 19.5 726.44 213.4 103. ... Object ID 72 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 841.92 re W* n BT /F1 12 Tf 1 0 0 1 71.424 795.24 Tm /GS7 gs 0 g /GS8 gs 0 G [( )] TJ ET Q q 0.000008871 0 595.32 841.92 re W* n Q q 19.5 726.44 213.4 103. ... Object ID 75 contains compressed stream data: /Artifact <</Attached [/Top]/Type/Pagination/Subtype/Header>> BDC q 0.000008871 0 595.32 841.92 re W* n BT /F1 12 Tf 1 0 0 1 71.424 795.24 Tm /GS7 gs 0 g /GS8 gs 0 G [( )] TJ ET Q q 0.000008871 0 595.32 841.92 re W* n Q q 19.5 726.44 213.4 103. ... Object ID 98 contains compressed stream data: 96 0 99 55 100 110 95 165 102 237 103 290 104 343 105 396 106 449 101 502 94 597 109 662 110 718 111 774 112 830 113 886 108 942 115 1033 116 1089 117 1145 114 1201 107 1276 123 1342 122 1398 126 1457 127 1523 125 1589 124 1664 121 1723 120 1790 128 1852 1 ... Object ID 335 contains compressed stream data: /CIDInit /ProcSet findresource begin 10 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespace ... Object ID 336 contains compressed stream data: \x00\x01\x00\x00\x00\x0f\x01\x00\x00\x04\x00@OS/2J\xf9\xa7\x06\x00\x00\x01x\x00\x00\x00`STAT\xd1\xfc\xcf\xff\x00\x00O\x88\x00\x00\x00|cmap\x1d\x88\x11>\x00\x00\x15\x88\x00\x00\x00\xb6cvt !\x9d\x15\xc6\x00\x00'\xd4\x00\x00\x00\xc0fpgmW\x8b\x0f\x10\x00\x0 ..., Object ID 339 contains compressed stream data: /CIDInit /ProcSet findresource begin 12 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespace ..., Object ID 340 contains compressed stream data: \x00\x01\x00\x00\x00 \x01\x00\x00\x04\x00 OS/2i\x88M\xb4\x00\x00\x01X\x00\x00\x00`cmapA\xe5<W\x00\x00 |\x00\x00\x02\xa8cvt \x14\xa2#\xa2\x00\x00\x1f\x08\x00\x00\x00\x82fpgm\x9e6\x14\xd0\x00\x00\x10$\x00\x00\x0e\x15glyfVaRU\x00\x00\x1f\x8c\x00\x00\x14Phe ..., Object ID 343 contains compressed stream data: /CIDInit /ProcSet findresource begin 32 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespace ..., Object ID 344 contains compressed stream data: \x00\x01\x00\x00\x00 \x01\x00\x00\x04\x00 OS/2g\xf8M\xad\x00\x00\x01X\x00\x00\x00`cmap \xf5C@\x00\x00 p\x00\x00\x03\xcecvt \x12\xf8!\xf2\x00\x00 $\x00\x00\x00\x82fpgm\x9e6\x14\xd0\x00\x00\x11@\x00\x00\x0e\x15glyf\xa5\xed\x01\xcf\x00\x00 \xa8\x00\x00T\x98he ..., Object ID 348 contains compressed stream data: \x00\x01\x00\x00\x00\x0e\x01\x00\x00\x04\x00pOS/2\x14I\x83T\x00\x00\x01h\x00\x00\x00`cmap/?\x0e\xf3\x00\x00AX\x00\x00\x02\x9ecvt \xad\xbf\xdf\x8e\x00\x00[\xd8\x00\x00\x06nfpgm8\xa5\x16+\x00\x00C\xf8\x00\x00?\xb0glyf+R{k\x00\x00bH\x00\x00\x14Bhead\xfa\xcb\x ..., Object ID 349 contains compressed stream data: /CIDInit /ProcSet findresource begin 26 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespace ..., Object ID 350 contains compressed stream data: \x00\x01\x00\x00\x00 \x01\x00\x00\x04\x00 OS/2i$M\xb5\x00\x00\x01X\x00\x00\x00`cmap\x1fl#\xfd\x00\x00 @\x00\x00\x03\xbacvt \x13\xeb"\xe9\x00\x00\x1f\xe0\x00\x00\x00\x82fpgm\x9e6\x14\xd0\x00\x00\x10\xfc\x00\x00\x0e\x15glyf\xd3\xc8\x93\xe4\x00\x00 d\x00\x00G ..., Object ID 353 contains compressed stream data: /CIDInit /ProcSet findresource begin 10 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespace ..., Object ID 354 contains compressed stream data: \x00\x01\x00\x00\x00\x11\x01\x00\x00\x04\x00pBASE.2\x8b\xdd\x00\x01\x86\xb0\x00\x00\x01\xbcEBDT\xa4E" \x00\x01\x84\xa8\x00\x00\x02\x07EBLC\x859J\xe1\x00\x01\x7f\xf4\x00\x00\x04\xb4OS/2U\xf2\x01?\x00\x00\x01\x98\x00\x00\x00`cmap\xa5\xdaHD\x00\x00\xbe4\x00\x ..., Object ID 356 contains compressed stream data: /CIDInit /ProcSet findresource begin 10 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespace ..., Object ID 357 contains compressed stream data: \x00\x01\x00\x00\x00\x0e\x01\x00\x00\x04\x00pOS/2\x1a|z\xd1\x00\x00\x01h\x00\x00\x00`cmap\xbf\xae\xaf\xe1\x00\x00A\xd8\x00\x00\x01\xc2cvt t\xe2\xf9\x9d\x00\x00]D\x00\x00\x08,fpgm7\x9ex\x10\x00\x00C\x9c\x00\x00\x06?glyf^\x97q,\x00\x00ep\x00\x00?Hhead\xfb\x8 ..., Object ID 360 contains compressed stream data: \x00\x01\x00\x00\x00\x0e\x01\x00\x00\x04\x00pOS/2\x15t\x84\x80\x00\x00\x01h\x00\x00\x00`cmap/?\x0e\xf3\x00\x00AX\x00\x00\x02\x9ecvt \xff\xc3\xadG\x00\x00\0\x00\x00\x07`fpgm\xba'\x11\xa6\x00\x00C\xf8\x00\x00\x06>glyfI\x1d?w\x00\x00c\x90\x00\x00\x0e\xb8he ... Object ID 361 contains compressed stream data: /CIDInit /ProcSet findresource begin 16 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespace ... Object ID 362 contains compressed stream data: \x00\x01\x00\x00\x00 \x01\x00\x00\x04\x00 OS/2g\xf9M\x8c\x00\x00\x01X\x00\x00\x00`cmap`X\x838\x00\x00 T\x00\x00\x03\x06cvt \x12\xf8!\xf5\x00\x00\x1f@\x00\x00\x00\x82fpgm\x9e6\x14\xd0\x00\x00\x10\\x00\x00\x0e\x15glyf\x92:Dp\x00\x00\x1f\xc4\x00\x00$\xe8head\ ... Object ID 366 contains compressed stream data: \x00\x01\x00\x00\x00\x0e\x01\x00\x00\x04\x00`OS/2\xf3\xff\xa3\x81\x00\x00\x01h\x00\x00\x00`cmap\x05\xfd\xfdZ\x00\x000\xf4\x00\x00\x02\x9ecvt GM \xba\x00\x00@\x98\x00\x00\x05ffpgm\xfal.\xf0\x00\x003\x94\x00\x00\x065glyf\xee] \x8b\x00\x00F\x00\x00\x00\x0f\x9 ... Object ID 367 contains compressed stream data: /CIDInit /ProcSet findresource begin 10 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespace ... Object ID 368 contains compressed stream data: \x00\x01\x00\x00\x00\x0e\x01\x00\x00\x04\x000OS/21\xce\xe42\x00\x00\x01h\x00\x00\x00Vcmap_\xc01?\x00\x00\x04\x98\x00\x00\x01Zcvt \xae/\xa9\xa9\x00\x00 \xa8\x00\x00\x05:fpgm\xc4\xf4;\xb0\x00\x00\x05\xf4\x00\x00\x04_glyfk\xf7\xb59\x00\x00\x12\xe4\x00\x00\x06 ...2b:Tdf2,"\Registry\Machine\Software\Classes\Interface\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp 00000000-00001120.00000001.148464.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{3BC3D253-2F31-4092-9129-8AD5ABF067DA}" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp 00000000-00001120.00000001.148464.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{EFE869FC-5841-55F1-AA56-82C7219AAA09}" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp 00000000-00001120.00000001.148464.43079000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp 00000000-00001120.00000001.148464.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp 00000000-00001120.00000001.148464.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{350E1244-4575-45EE-8595-0AA8C6506FC7}" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp 00000000-00001120.00000001.148464.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{D81E96F1-A89C-417E-9335-59531026309D}" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp 00000000-00001120.00000001.148464.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Directory\ShellEx\PropertyHandler" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp 00000000-00001120.00000001.148464.43079000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp 00000000-00001120.00000001.148464.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}" in Source: 00000000-00001120.00000000.146834.430C6000.00000004.mdmp 00000000-00001120.00000001.148464.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001120.00000000.146834.430C6000.00000004.mdmp 00000000-00001120.00000001.148464.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001120.00000000.146834.430C6000.00000004.mdmp 00000000-00001120.00000001.148464.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00001120.00000000.146834.430C6000.00000004.mdmp 00000000-00001120.00000001.148464.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}" in Source: 00000000-00001120.00000000.146834.430C6000.00000004.mdmp 00000000-00001120.00000001.148464.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001120.00000000.146834.430C6000.00000004.mdmp 00000000-00001120.00000001.148464.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00001120.00000000.146834.430C6000.00000004.mdmp 00000000-00001120.00000001.148464.430C6000.00000004.mdmp "S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00001120.00000000.146834.430C6000.00000004.mdmp 00000000-00001120.00000001.148464.430C6000.00000004.mdmp2c:Tf24,Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8744:168:WilStaging_02" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Acrobat Instance Mutex" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8744:168:WilStaging_02" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8744:64:WilError_03" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBWinMutex" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\DirectSound DllMain mutex (0x00002228)" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit" Process AcroRd32.exe created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer"2d:T1987,"\Registry\Machine\Software\Classes\Interface\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{3BC3D253-2F31-4092-9129-8AD5ABF067DA}" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{EFE869FC-5841-55F1-AA56-82C7219AAA09}" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{350E1244-4575-45EE-8595-0AA8C6506FC7}" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{D81E96F1-A89C-417E-9335-59531026309D}" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Directory\ShellEx\PropertyHandler" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001120.00000000.146834.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}" in Source: 00000000-00001120.00000000.146834.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001120.00000000.146834.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001120.00000000.146834.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00001120.00000000.146834.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}" in Source: 00000000-00001120.00000000.146834.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001120.00000000.146834.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00001120.00000000.146834.430C6000.00000004.mdmp "S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00001120.00000000.146834.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}" in Source: 00000000-00001120.00000001.148464.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{3BC3D253-2F31-4092-9129-8AD5ABF067DA}" in Source: 00000000-00001120.00000001.148464.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{EFE869FC-5841-55F1-AA56-82C7219AAA09}" in Source: 00000000-00001120.00000001.148464.43079000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}" in Source: 00000000-00001120.00000001.148464.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}" in Source: 00000000-00001120.00000001.148464.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{350E1244-4575-45EE-8595-0AA8C6506FC7}" in Source: 00000000-00001120.00000001.148464.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{D81E96F1-A89C-417E-9335-59531026309D}" in Source: 00000000-00001120.00000001.148464.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\Directory\ShellEx\PropertyHandler" in Source: 00000000-00001120.00000001.148464.43079000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001120.00000001.148464.43079000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}" in Source: 00000000-00001120.00000001.148464.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001120.00000001.148464.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001120.00000001.148464.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00001120.00000001.148464.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}" in Source: 00000000-00001120.00000001.148464.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001120.00000001.148464.430C6000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00001120.00000001.148464.430C6000.00000004.mdmp "S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00001120.00000001.148464.430C6000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001120.00000001.148464.4F9A0000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00001120.00000001.148464.4F9A0000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00001120.00000001.148464.9BF81000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00001120.00000001.148464.9BF81000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00001120.00000001.148464.9BF81000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00001120.00000001.148464.9BF81000.00000002.mdmp "Software\" in Source: 00000000-00001120.00000001.148464.9BF81000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00001120.00000001.148464.9BF81000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00001120.00000001.148464.9BF81000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00001120.00000001.148464.9BF81000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001120.00000001.148464.9BF81000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005148.00000000.146508.4F9A0000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00005148.00000000.146508.4F9A0000.00000002.mdmp2e:Tf92,"identity_helper.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff9ac5a0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff9c3eb0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff9c3eb0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ff9c3eb0000 "identity_helper.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ff9c3d70000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff9c3eb0000 "identity_helper.exe" loaded module "KERNEL32" at base 7ff9c4750000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff9c3eb0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff9c3eb0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff9c3eb0000 "identity_helper.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 7ff9c5030000 "identity_helper.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGE\APPLICATION\145.0.3800.58\MSEDGE.DLL" at base 7ff9755d0000 "identity_helper.exe" loaded module "ADVAPI32.DLL" at base 7ff9c5150000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9c1640000 "identity_helper.exe" loaded module "USER32.DLL" at base 7ff9c6420000 "identity_helper.exe" loaded module "SHELL32.DLL" at base 7ff9c48c0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff9c5460000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff9c5460000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\EXECMODELCLIENT.DLL" at base 7ff9acd70000 "identity_helper.exe" loaded module "RPCRT4.DLL" at base 7ff9c4630000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff9c5460000 "identity_helper.exe" loaded module "OLE32.DLL" at base 7ff9c5fb0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.APPCORE.DLL" at base 7ff9be330000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WPNAPPS.DLL" at base 7ff9aa810000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 7ff9b0410000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\EXECMODELPROXY.DLL" at base 7ff9abd80000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ff9bd500000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ff9b4310000 "identity_helper.exe" loaded module "NTDLL.DLL" at base 7ff9c6610000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.APPLICATIONMODEL.DLL" at base 7ff9aeec0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff9c3d70000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTOWINRT.DLL" at base 7ff9b8cd0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ff9bf5e0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\TILEDATAREPOSITORY.DLL" at base 7ff9ab530000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\USERMGRPROXY.DLL" at base 7ff9ba690000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\BIWINRT.DLL" at base 7ff9ab6b0000 "identity_helper.exe" loaded module "GDI32.DLL" at base 7ff9c5210000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.INTERNAL.SHELL.BROKER.DLL" at base 7ff9a6190000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\PCSHELLCOMMONPROXYSTUB.DLL" at base 7ff9a7460000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\STARTTILEDATA.DLL" at base 7ff9aaf60000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.APPLICATIONDATA.DLL" at base 7ff9aa770000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff9be6d0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff9c1d300002f:T1592,Process "msedge.exe" (UID: 00000000-00009212) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "msedge.exe" (UID: 00000000-00009212) was launched with modified environment variables: "PSModulePath, Path, PATHEXT" Process "msedge.exe" (UID: 00000000-00009212) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, PROMPT, FPS_BROWSER_USER_PROFILE_STRING" Process "msedge.exe" (UID: 00000000-00005020) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_9212_WRSWQDVGQAUIWPZL", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="9212"" Process "msedge.exe" (UID: 00000000-00007644) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="12", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00006812) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "identity_helper.exe" (UID: 00000000-00005148) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="cN45d5WF96JjFa0", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="12", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="S1N2kDX", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", NODE_PATH="%PROGRAMFILES%\nodejs\node_modules", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", OS="Windows_NT", COMPUTERNAME="cN45d5WF96JjFa0", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\S1N2kDX", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\S1N2kDX", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00004612) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00001656) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="cN45d5WF96JjFa0", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="12", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="S1N2kDX", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", NODE_PATH="%PROGRAMFILES%\nodejs\node_modules", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", OS="Windows_NT", COMPUTERNAME="cN45d5WF96JjFa0", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\S1N2kDX", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\S1N2kDX", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753""30:T8d7,Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00009212) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00005020), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00007644), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00005332), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00006812), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00008824), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00008476), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00008536), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00003368), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00005148), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00001120), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00008140), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00005348), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00004612), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00001656), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00005516)31:T8d7,Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00009212) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00005020), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00007644), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00005332), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00006812), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00008824), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00008476), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00008536), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00003368), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00005148), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00001120), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00008140), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00005348), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00004612), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00001656), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00005516)32:Te7c,The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 1E:DC:43:E6:4D:A1:CA:5F:F3:EA:6C:1A:88:82:C5:D5:F3:29:06:4B; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 46:51:6F:1C:A2:80:2A:2A:A3:AE:65:CD:BF:38:0C:0A:D4:05:06:73; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: B9:69:05:48:E2:96:BA:A8:A5:D0:B0:B2:3C:48:3C:CC:DA:69:16:DF; see report for more information) The input sample is signed with a certificate issued by "CN=YE1, O=Let's Encrypt, C=US" (SHA1: C7:23:62:DB:C4:3E:C6:5F:57:15:ED:F4:3A:8A:84:E9:95:16:8E:2B; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: D0:93:70:A9:86:49:82:A5:04:7D:A4:63:73:54:02:56:D0:8A:3C:81; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 76:7A:3B:FA:D0:F8:92:94:22:AC:46:9B:F5:92:44:E3:9B:62:43:32; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=YR2, O=Let's Encrypt, C=US" (SHA1: 9B:D6:05:CF:53:12:E9:C4:85:B4:5A:38:E9:16:D9:54:F2:3B:F6:DB; see report for more information) The input sample is signed with a certificate issued by "CN=Root YR, O=ISRG, C=US" (SHA1: 2D:74:D6:DF:D9:6E:EA:55:AD:7B:AA:FA:0D:3C:65:52:B2:DA:DC:37; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 72:06:CD:65:E8:BC:E3:FE:8C:BB:1A:B8:0B:5F:29:3F:16:1D:A3:64; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 9C:FF:31:B5:1D:22:B9:BF:D3:80:8A:8C:35:B4:BB:DF:36:13:71:F0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: 27:E6:66:32:99:D3:40:DF:E5:45:71:CE:CC:EC:01:BE:74:49:5D:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information)33:T14aa,"GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: layercraftlog.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.innostation3d.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: nhimg.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: beltsintaekwondo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: www.taekwondoclasses.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: thetaekwondo.app User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: www.mdc-berlin.de User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: makerly.eu User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image"34:Ta0e,"A9Rma6bkw_14b2int_6qw.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rma6bkw_14b2int_6qw.tmp]- [targetUID: 00000000-00008744] "A9R7k2rkc_14b2ins_6qw.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9R7k2rkc_14b2ins_6qw.tmp]- [targetUID: 00000000-00008744] "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00008744] "A9R9202th_14b2inu_6qw.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9R9202th_14b2inu_6qw.tmp]- [targetUID: 00000000-00008744] "Annssi.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00008744] "urlref_httpsodisse.santepubliquefrance.frbulletin-ira" has type "HTML document Unicode text UTF-8 text with very long lines (12463) with no line terminators"- [targetUID: N/A] "Annss.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00008744] "urlref_httpssolidarites.gouv.frrecommandations-sanitaires-conduite-tenir-dans-les-esm-face-aux-ira" has type "HTML document ASCII text with very long lines (915) with CRLF LF line terminators"- [targetUID: N/A] "addressbook.acrodata" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00008744] "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" has type " sha1WithRSAEncryption countryName=US"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00008744] "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00008744] "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" has type " sha1WithRSAEncryption countryName=US"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00008744] "Annssk.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00008744] "FAPDC1C.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\FAPDC1C.tmp]- [targetUID: 00000000-00008744] "A9Rsgesa1_14b2inr_6qw.tmp" has type "data"- Location: [%TEMP%\A9Rsgesa1_14b2inr_6qw.tmp]- [targetUID: 00000000-00008744]35:T919,"identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}\"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{00000035-0000-0000-C000-000000000046}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{00000035-0000-0000-C000-000000000046}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{00000035-0000-0000-C000-000000000046}\PROXYSTUBCLSID32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{00000035-0000-0000-C000-000000000046}\PROXYSTUBCLSID32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}"; Key: ""; Value: "")36:Te34,"identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}"; Key: "DATA"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}"; Key: "GENERATION"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{00000035-0000-0000-C000-000000000046}\PROXYSTUBCLSID32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}\PROXYSTUBCLSID32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}\PROXYSTUBCLSID32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E36C4458-ED80-4AD7-A8BE-52DDA1EB5F1C"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "1AFF6089-E863-4D36-BDFD-3581F07440BE"; Value: "")37:T672,"identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\msedge_elf.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\dbghelp.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\dbghelp.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\WINMM.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\WINMM.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\FLTLIB.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\FLTLIB.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\MSVCP140.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\VCRUNTIME140.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\VCRUNTIME140_1.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\CRYPTSP.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\CRYPTSP.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\PROPSYS.dll"38:T7f0,file/memory contains long string with (Indicator: " connect "; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 day and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found reference to API "other {This device will be saved for {DAYS} days and you can connect without a code next time. This is set by your administrator.}}{HOURS, plural," (Indicator: " connect "; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 hour and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found reference to API "other {This device will be saved for {HOURS} hours and you can connect without a code next time. This is set by your administrator.}}{MONTHS, plural," (Indicator: " connect "; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 month and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found reference to API "other {This device will be saved for {MONTHS} months and you can connect without a code next time. This is set by your administrator.}}{YEARS, plural," (Indicator: " connect "; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 year and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") file/memory contains long string with (Indicator: " bind "; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp")39:T2d05,Found URL "https://www.office.comthumbnail" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2093703https://go.microsoft.com/fwlink/?linkid=2348603sites" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://support.google.com/chromebook?p=app_intent" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2118167" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/en-us/privacystatementyou're" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://aka.ms/edgepreviewhttps://aka.ms/enterprisepreviewuserto" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2149872an" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2165400to" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2165278https://go.microsoft.com/fwlink/?linkid=2348701https://go.microsoft.com/fwlink/?linkid=2165325https://go.microsoft.com/fwlink/?linkid=2348900use" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2239343https://go.microsoft.com/fwlink/?linkid=2288290show" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2301855allow" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2149000browsing" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2194724ai-powered" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/microsoft-edge/microsoft-edge-browsing-activity-for-personalized-advertising-and-experiences-37aa831e-6372-238e-f33f-7cd3f0e53679allow" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/microsoft-365/family-safetyhttps://family.microsoft.com/?ref=edge://settings/familysafetyhttps://go.microsoft.com/fwlink/?linkid=2127630set" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/account-billing/view-device-and-app-use-with-family-safety-activity-reporting-b7b8501e-e35c-2224-bed8-115d5da4fbafto" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/account-billing/filter-websites-and-searches-using-microsoft-family-safety-3034d91e-5efa-9fbe-1384-46009f087ccfto" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://microsoftedgetips.microsoft.com/en-us/internet" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2211966writing" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://support.microsoft.com/office/microsoft-editor-checks-grammar-and-more-in-documents-mail-and-the-web-91ecbe1b-d021-4e9e-a82e-abc4cd7163d7are" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=521839microsoft" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2279846see" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2166676learn" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://easylist.to/easylist/easylist.txtthe" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://easylist.to/index.htmlallow" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2181135adds" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2161865alerts" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://aka.ms/techscam-detection-learn-moreblock" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=529732manage" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2105403this" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2114187https://go.microsoft.com/fwlink/?linkid=2077327edit" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2121003when" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/servicesagreementmanage" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2101140change" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://aka.ms/accountsecuritylearn" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://aka.ms/synclearnmorelinkprofile" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/deployedge/edge-learnmore-reset-data-in-cloudreset" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2333202save" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2167671use" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://example.comsuper" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2257424keep" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/edge/features/real-time-video-translation?form=ma13fj&ch=1show" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://microsoft.com/en-us/edge/ai-powered/copilot-mode?form=ma140nhttps://microsoft.com/en-us/edge/ai-powered/copilot-mode?form=ma140mcopilot" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337798https://go.microsoft.com/fwlink/?linkid=2337885explore" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337628https://go.microsoft.com/fwlink/?linkid=2345959explore" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337721https://go.microsoft.com/fwlink/?linkid=2345869discover" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addons" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addonsno" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://aka.ms/edgeprintingtroubleshooting" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://aka.ms/printtroubleshootingneed" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2126235if" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://www.bing.com/new/termsofuseenhanceenhance" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://www.microsoft.com/edge/copilot-mode?form=mg0awropen" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/copilot/privacy-and-protections" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/microsoft-365-copilot/microsoft-365-copilot-privacy" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://aka.ms/whatisscarewarequick" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2107360&clcid=0x409hi," - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "http://force" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2164373" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2164373the" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addons?hl=enhttps://www.whatsapp.comhttps://www.facebook.comhttps://www.youtube.comhttps://www.outlook.com/allow" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2151738learn" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "http://example.com" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://example.com.your" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://support.google.com/chrome/a/answer/9122284" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "http://.

" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "http://," - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "http://example.com." - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/p/?linkid=2114059" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/p/\?linkid=158334https://support.microsoft.com/en-us/windows/microsoft-edge-" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/topic/protect-your-online-accounts-using-password-monitor-6f660aae-65aa-476c-871a-7fe2bcb0c4c1let's" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2193240check" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/en-us/privacystatement" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2189718protected" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/privacystatementalways" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "https://m365.cloud.microsoft/chat?fromcode=cmm63o75lj0let's" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found URL "http://microsoft.com/edge/surfintroducing" - Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp")3a:T41d9,GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: 1c3d.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=filamente.de?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: layercraftlog.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=pokershield.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=gamblingnews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: clark.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.goodmoneysense.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.fractionalbrandmanagers.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.innostation3d.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: www.orchestry.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: nhimg.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: solvingmicrosoft365.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /hubfs/Logos/Brand%20Update%202023/Orchestry%20-%20Favicon%20001.png HTTP/2 Host: www.orchestry.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Cookie: __cf_bm=8qf9nyuDK0JKo8HvwZxJNZsjJyvhjj1sS6sPDEdBSlo-1793868797.9562507-1.0.1.1-UOZs0mTmnRfFu0e.AxonyYkJFJ3b.9RbvQI4Qz0V9OeePqFEqYcMDd71BXWxWl2qWzP3sXsJ_rMxJGh4EZfs7jZnXaD10Xu5fbzxGJGfQd_Hm074XPcx7mkTafSr2W4b Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=note.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: www.solvingmicrosoft365.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: beltsintaekwondo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: www.taekwondoclasses.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: taekwondoking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=gymdesk.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: thetaekwondo.app User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: cybertaekwondo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /wp-content/uploads/2025/01/cropped-cropped-transparent_transparent1-2.png-100x100.webp HTTP/2 Host: cybertaekwondo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: www.mybergen.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: www.mdc-berlin.de User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: github.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image 3b:Tb1a,Contains base62 string in header "8qf9nyuDK0JKo8HvwZxJNZsjJyvhjj1sS" in header "GET /hubfs/Logos/Brand%20Update%202023/Orchestry%20-%20Favicon%20001.png HTTP/2Host: www.orchestry.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=8qf9nyuDK0JKo8HvwZxJNZsjJyvhjj1sS6sPDEdBSlo-1793868797.9562507-1.0.1.1-UOZs0mTmnRfFu0e.AxonyYkJFJ3b.9RbvQI4Qz0V9OeePqFEqYcMDd71BXWxWl2qWzP3sXsJ_rMxJGh4EZfs7jZnXaD10Xu5fbzxGJGfQd_Hm074XPcx7mkTafSr2W4bPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "9RbvQI4Qz0V9OeePqFEqYcMDd71BXWxWl" in header "GET /hubfs/Logos/Brand%20Update%202023/Orchestry%20-%20Favicon%20001.png HTTP/2Host: www.orchestry.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=8qf9nyuDK0JKo8HvwZxJNZsjJyvhjj1sS6sPDEdBSlo-1793868797.9562507-1.0.1.1-UOZs0mTmnRfFu0e.AxonyYkJFJ3b.9RbvQI4Qz0V9OeePqFEqYcMDd71BXWxWl2qWzP3sXsJ_rMxJGh4EZfs7jZnXaD10Xu5fbzxGJGfQd_Hm074XPcx7mkTafSr2W4bPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "rMxJGh4EZfs7jZnXaD10Xu5fbzxGJGfQd" in header "GET /hubfs/Logos/Brand%20Update%202023/Orchestry%20-%20Favicon%20001.png HTTP/2Host: www.orchestry.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=8qf9nyuDK0JKo8HvwZxJNZsjJyvhjj1sS6sPDEdBSlo-1793868797.9562507-1.0.1.1-UOZs0mTmnRfFu0e.AxonyYkJFJ3b.9RbvQI4Qz0V9OeePqFEqYcMDd71BXWxWl2qWzP3sXsJ_rMxJGh4EZfs7jZnXaD10Xu5fbzxGJGfQd_Hm074XPcx7mkTafSr2W4bPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image"3c:Tbc8,Found HTTPS GET request to https://1c3d.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=filamente.de?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://layercraftlog.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=pokershield.org?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=gamblingnews.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://clark.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://www.goodmoneysense.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://www.fractionalbrandmanagers.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://www.innostation3d.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://www.orchestry.com/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://nhimg.org/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://solvingmicrosoft365.com/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://www.orchestry.com/hubfs/Logos/Brand%20Update%202023/Orchestry%20-%20Favicon%20001.png Found HTTPS GET request to https://services.bingapis.com/favicon?url=note.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://www.solvingmicrosoft365.com/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://beltsintaekwondo.com/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://www.taekwondoclasses.net/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://taekwondoking.com/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=gymdesk.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://thetaekwondo.app/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://cybertaekwondo.com/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://cybertaekwondo.com/wp-content/uploads/2025/01/cropped-cropped-transparent_transparent1-2.png-100x100.webp Found HTTPS GET request to https://www.mybergen.com/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://www.mdc-berlin.de/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://github.com/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t3d:T614,Short term registered certificate: "1c3d.com" (90 days old) Short term registered certificate: "beltsintaekwondo.com" (90 days old) Short term registered certificate: "clark.com" (90 days old) Short term registered certificate: "classicbands.com" (89 days old) Short term registered certificate: "clients2.googleusercontent.com" (83 days old) Short term registered certificate: "cybertaekwondo.com" (89 days old) Short term registered certificate: "eddiebrigati.com" (90 days old) Short term registered certificate: "github.com" (89 days old) Short term registered certificate: "layercraftlog.com" (89 days old) Short term registered certificate: "makerly.eu" (89 days old) Short term registered certificate: "nhimg.org" (90 days old) Short term registered certificate: "solvingmicrosoft365.com" (90 days old) Short term registered certificate: "thetaekwondo.app" (89 days old) Short term registered certificate: "vprint3d.com.hk" (89 days old) Short term registered certificate: "www.fractionalbrandmanagers.com" (89 days old) Short term registered certificate: "www.goodmoneysense.com" (89 days old) Short term registered certificate: "www.innostation3d.com" (89 days old) Short term registered certificate: "www.mdc-berlin.de" (29 days old) Short term registered certificate: "www.mybergen.com" (90 days old) Short term registered certificate: "www.orchestry.com" (90 days old) Short term registered certificate: "www.solvingmicrosoft365.com" (90 days old) Short term registered certificate: "www.taekwondoclasses.net" (89 days old)3e:T487,Found string "B+ncalrpc:[OLEE322D287AB317776A0F9152A387E]" (Indicator: "ncalrpc"; Source: "00000000-00001120.00000000.146834.43079000.00000004.mdmp, 00000000-00001120.00000001.148464.43079000.00000004.mdmp") Found string "F+ncalrpc:[OLE2E262BA278293123085D66BBDCC3]" (Indicator: "ncalrpc"; Source: "00000000-00001120.00000000.146834.43079000.00000004.mdmp, 00000000-00001120.00000000.146834.430C6000.00000004.mdmp, 00000000-00001120.00000001.148464.43079000.00000004.mdmp, 00000000-00001120.00000001.148464.430C6000.00000004.mdmp") Found string "F+ncalrpc:[OLE4D4D402FC973D3172D250D68DED6]" (Indicator: "ncalrpc"; Source: "00000000-00001120.00000000.146834.43079000.00000004.mdmp, 00000000-00001120.00000001.148464.43079000.00000004.mdmp") Found string "F+ncalrpc:[OLE6EE1A0721F53BA67737477DC59B7]" (Indicator: "ncalrpc"; Source: "00000000-00001120.00000000.146834.43079000.00000004.mdmp, 00000000-00001120.00000001.148464.43079000.00000004.mdmp") Found string "B+ncalrpc:[OLEF75D75E1B6898374D2F3F31BE6C9]" (Indicator: "ncalrpc"; Source: "00000000-00001120.00000000.146834.43079000.00000004.mdmp, 00000000-00001120.00000001.148464.43079000.00000004.mdmp")3f:T1297,Found string "password_manager.mojom.CSVPasswordParser" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.00004000.00000004.mdmp") Found string "password_manager.breach_detection.mojom.EdgePasswordDataProcessor" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.00054000.00000004.mdmp") Found string "your password stays on your deviceAdding to Microsoft Edge" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "=1 {1 password is saved only to this device. To use it on your other devices, save it in your Google Account. This will also clean up any duplicates.}" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "other {{PASSWORD_COUNT} passwords are saved only to this device. To use them on your other devices, save them in your Google Account. This will also clean up any duplicates.}" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "=1 {1 password and other items are saved only to this device. To use them on your other devices, save them in your Google Account. This will also clean up any duplicates.}" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "other {{PASSWORD_COUNT} passwords and other items are saved only to this device. To use them on your other devices, save them in your Google Account. This will also clean up any duplicates.}" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "=1 {1 password is saved only to this device. To use it on your other devices, save it in your Google Account.}" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "other {{PASSWORD_COUNT} passwords are saved only to this device. To use them on your other devices, save them in your Google Account.}" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "=1 {1 password and other items are saved only to this device. To use them on your other devices, save them in your Google Account.}" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "other {{PASSWORD_COUNT} passwords and other items are saved only to this device. To use them on your other devices, save them in your Google Account.}" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "ve imported 1 password into Microsoft Password Manager on this device.Great! We" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "ve imported $1 passwords into Microsoft Password Manager on this device.We" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "ve imported your passwordsTo continue to save your passwords in Microsoft Edge, turn on" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "=1 {Found 1 compromised password}" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "other {Found {NUM_SITES} compromised passwords}}{NUM_SITES, plural," (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "=0 {No compromised passwords}" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "=1 {{COUNT} compromised password}" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "other {{COUNT} compromised passwords}}{COUNT, plural," (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "=0 {Your passwords are unique}" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "=1 {{COUNT} reused password}" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "other {{COUNT} reused passwords}}Create unique passwords{COUNT, plural," (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "=0 {Your passwords look strong}" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp") Found string "=1 {{COUNT} weak password}" (Indicator: "password"; Source: "00000000-00001120.00000000.146834.463E0000.00000002.mdmp")40:T52d,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001120.00000000.146834.00054000.00000004.mdmp, 00000000-00001120.00000000.146834.43100000.00000004.mdmp, 00000000-00001120.00000001.148464.00054000.00000004.mdmp, 00000000-00001120.00000001.148464.43100000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001120.00000000.146834.00054000.00000004.mdmp, 00000000-00001120.00000000.146834.43100000.00000004.mdmp, 00000000-00001120.00000001.148464.00054000.00000004.mdmp, 00000000-00001120.00000001.148464.43100000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{815ead30-0000-0000-0000-100000000000}" (Indicator: "\Device\"; Source: "00000000-00001120.00000000.146834.430C6000.00000004.mdmp, 00000000-00001120.00000001.148464.430C6000.00000004.mdmp") Found string "C:\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001120.00000000.146834.430C6000.00000004.mdmp, 00000000-00001120.00000001.148464.430C6000.00000004.mdmp") Found string "\Microsoft\PolicyManager\current\Device\Privacy" (Indicator: "\Device\"; Source: "00000000-00001120.00000000.146834.43100000.00000004.mdmp, 00000000-00001120.00000001.148464.43100000.00000004.mdmp")41:T524,Dropped file: "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00008744] Dropped file: "Annssi.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00008744] Dropped file: "Annss.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00008744] Dropped file: "addressbook.acrodata" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00008744] Dropped file: "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00008744] Dropped file: "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00008744] Dropped file: "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00008744] Dropped file: "Annssk.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00008744]42:T1a5a,"MESSAGES CL\xc9S \x2192 A l\x2019approche de la saison hivernale, i l est n\xe9cessaire de promouvoir activement au sein de vos patient\xe8les et chez vos r\xe9sidents les mesures barri\xe8res ainsi que la vaccination pour les publics qui y sont \xe9ligibles. \x2192 Le port du masque est fortement recommand\xe9 pour les patients et professionnels de sant\xe9 pr\xe9sentant des sympt\xf4mes respiratoires, lors de la prise en charge de patients vuln\xe9rables ou symptomatiques. \x2192 Il vous est rappel\xe9 que, depuis la derni\xe8re saison, les responsables d\x2019\xe9tablissements sanitaires et m\xe9dico-sociaux peuvent pr\xe9coniser l\x2019obligation de port du masque au sein de leur structure. La mise en \x153uvre de la mesure sera pr\xe9conis\xe9e par votre Agence r\xe9gionale de sant\xe9 lorsque la situation \xe9pid\xe9miologique r\xe9gionale le justifiera. \x2192 Les situations r\xe9gionales et nationales peuvent \xeatre suivies \xe0 tout moment sur la plateforme ODISSE de Sant\xe9 publique France : ODISSE - Sant\xe9 Publique France MARS MESSAGE D\x2019ALERTE RAPIDE SANITAIRE \xc9metteurs : Direction g\xe9n\xe9rale de la sant\xe9 Direction g\xe9n\xe9rale de l\x2019offre de soins Direction g\xe9n\xe9rale de la coh\xe9sion sociale \xc0 l\x2019attention de : \x2612 Etablissements de sant\xe9 \x2612 Etablissement m\xe9dico-sociaux ZONE G\xc9OGRAPHIQUE CONCERN\xc9E \x202f \x2612 Nationale \x2610 Territoriale Date\x202f: 04/11/2026 R\xe9f\xe9rence\x202f: n\xb02026_15 Pr\xe9vention des infections respiratoires aigu\xebs (IRA) et pr\xe9paration de la saison hivernale 2026-2027" "N\xe9anmoins, cette p\xe9riode doit permettre de maximiser les couvertures vaccinales, d\x2019organiser l\x2019offre de vaccination, d\x2019informer les professionnels de leurs futures obligations et d\x2019identifier les \xe9ventuelles difficult\xe9s op\xe9rationnelles en vue de la mise en \x153uvre du dispositif. 2. La promotion des mesures barri\xe8res dont le port du masque en \xe9tablissement de sant\xe9 et \xe9tablissements m\xe9dico-sociaux a. Promotion des mesures barri\xe8res En p\xe9riode d\x2019\xe9pid\xe9mie communautaire, il est essentiel de renforcer la promotion, l\x2019adh\xe9sion individuelle et collective aux mesures barri\xe8res au sein de la population. Parmi ces gestes applicables figurent notamment : \x25aa L\x2019hygi\xe8ne r\xe9guli\xe8re des mains ; \x25aa Les mesures d\x2019a\xe9ration et de ventilation des espaces clos. Le port du masque est en outre \xe0 recommander en permanence : \x25aa Pour toute personne pr\xe9sentant des sympt\xf4mes d'infection respiratoire aigu\xeb ; \x25aa Pour les professionnels, b\xe9n\xe9voles, visiteurs, transporteurs ou personnels au contact d'une personne symptomatique d'une infection respiratoire aigu\xeb ; \x25aa Pour les professionnels et b\xe9n\xe9voles pr\xe9sentant un risque accru de forme grave d'infection respiratoire, m\xeame en l'absence de sympt\xf4mes. Le masque \xe0 usage m\xe9dical demeure la r\xe9f\xe9rence pour l'application des mesures de pr\xe9vention et de contr\xf4le de la transmission des infections respiratoires. Le recours au masque FFP2 doit \xeatre privil\xe9gi\xe9 pour : \x25aa Les professionnels et b\xe9n\xe9voles asymptomatiques \xe0 risque de formes graves, ou pendant la p\xe9riode d\x2019\xe9pid\xe9mie communautaire d\x2019infections respiratoires, lors de toute proc\xe9dure g\xe9n\xe9rant un a\xe9rosol pour tout patient, quel que soit son statut, ou si actes \xe0 risque ; \x25aa Les personnels intervenant \xe0 domicile en cas de soins g\xe9n\xe9rant des a\xe9rosols. Nous vous invitons \xe0 accompagner ces recommandations d\x2019une information par voie d\x2019affichage et sur le site internet de l\x2019\xe9tablissement." "b. Mise en place de l\x2019obligation du port du masque en \xe9tablissements Au-del\xe0 des recommandations permanentes, le port du masque peut \xeatre rendu obligatoire par les responsables d'\xe9tablissement lorsque la situation \xe9pid\xe9miologique le n\xe9cessite. C\x2019est sur la base de l\x2019indicateur \xab IRA basses \xbb produit chaque semaine par Sant\xe9 publique France (SpF) \xe0 l\x2019\xe9chelle r\xe9gionale que votre Agence r\xe9gionale de sant\xe9 ( ARS) pourra vous proposer de rendre le port du masque obligatoire au sein de votre \xe9tablissement, d\xe8s lors que cet indicateur atteint le \xab seuil d'alerte \xbb. Cette obligation du port du masque pourra s\x2019appliquer d\xe8s lors, y compris en l'absence de sympt\xf4mes, et ce d\xe8s l'entr\xe9e : \x25aa Dans les \xe9tablissements de sant\xe9 (ES) : \xe0 l'ensemble des professionnels, intervenants, patients et visiteurs ; \x25aa Dans les \xe9tablissements et services m\xe9dico -sociaux (ESMS) : aux professionnels, visiteurs, r\xe9sidents accueillis sans nuit\xe9e, b\xe9n\xe9voles, transporteurs et intervenants \xe0 domicile. Votre ARS vous proposera de lever l\x2019obligation apr\xe8s deux semaines cons\xe9cutives durant lesquelles l'indicateur sera rest\xe9 sous le seuil d'alerte r\xe9gional. Au-del\xe0 de l\x2019indicateur , et si le responsable de structure l\x2019estime n\xe9cessaire, i l peut \xeatre consid\xe9r\xe9 que d\xe8s l'entr\xe9e en phase \xe9pid\xe9mique de la grippe ou de la bronchiolite, le port du masque doit faire l'objet d'une recommandation forte pour l\x2019ensemble des personnes pr\xe9sentes dans les \xe9tablissements de sant\xe9 et \xe9tablissements m\xe9dicaux sociaux. Les situations \xe9pid\xe9miologiques r\xe9gionales et nationales peuvent \xeatre suivies \xe0 tout moment sur la plateforme ODISSE de Sant\xe9 publique France. Les directeurs d'\xe9tablissement conservent la possibilit\xe9 d'adapter ces dispositions \xe0 leur situation locale. Ces d\xe9cisions pourront \xeatre prises sur avis des Equipes op\xe9rationnelles d'hygi\xe8ne (EOH) ou des Equipes mobiles d'hygi\xe8ne (EMH). c. Situations particuli\xe8res et d\xe9rogations Des situations peuvent justifier le non-port du masque : d\xe9rogations pour certaines personnes en situation de handicap, ou autres difficult\xe9s (ex. masque \xe0 O2, etc.), troubles neurocognitifs ou psychiatriques, enfants de moins de 6 ans. Dans ce cas, il convient de veiller \xe0 ce que toutes les autres personnes pr\xe9sentes (en capacit\xe9 d\x2019en porter) en portent un. S\x2019agissant des r\xe9sidents d\x2019ESMS, des mesures compl\xe9mentaires de port du masque (m\xeame en l\x2019absence de sympt\xf4mes) d\xe8s l\x2019entr\xe9e dans l\x2019enceinte de l\x2019\xe9tablissement et/ou la sortie de la chambre peuvent \xeatre appliqu\xe9es en cas de d\xe9gradation de la situation sanitaire ou de survenue de cas group\xe9s dans l\x2019\xe9tablissement. Cette disposition est fond\xe9e sur la n\xe9cessit\xe9 de"43:T1413,Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.11 on port 80 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 52.123.251.11 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 13.32.241.52 on port 443 (TCP); Domain: "sb.scorecardresearch.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.12 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 172.67.149.17 on port 443 (TCP); Domain: "1c3d.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 172.67.221.69 on port 443 (TCP); Domain: "layercraftlog.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.10 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 107.181.241.146 on port 443 (TCP); Domain: "www.goodmoneysense.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 104.24.88.18 on port 443 (TCP); Domain: "clark.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 172.66.3.8 on port 443 (TCP); Domain: "www.fractionalbrandmanagers.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 23.227.38.74 on port 443 (TCP); Domain: "www.innostation3d.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 74.151.238.128 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 199.60.103.2 on port 443 (TCP); Domain: "www.orchestry.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 172.67.171.129 on port 443 (TCP); Domain: "nhimg.org" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 172.67.215.75 on port 443 (TCP); Domain: "www.solvingmicrosoft365.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.74.13 on port 443 (TCP); Domain: "services.bingapis.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 104.21.24.12 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.10 on port 443 (TCP); Domain: "r.msftstatic.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 172.67.211.221 on port 443 (TCP); Domain: "beltsintaekwondo.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 68.65.120.151 on port 443 (TCP); Domain: "taekwondoking.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 76.76.21.98 on port 443 (TCP); Domain: "www.taekwondoclasses.net" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 104.21.32.85 on port 443 (TCP); Domain: "thetaekwondo.app" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 23.61.246.197 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 35.212.84.29 on port 443 (TCP); Domain: "cybertaekwondo.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.110.7 on port 443 (TCP); Domain: "edge-consumer-static.azureedge.net" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.11 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 142.251.219.46 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 142.251.218.129 on port 443 (TCP); Domain: "clients2.googleusercontent.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 185.242.134.76 on port 443 (TCP); Domain: "3dx.info" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 172.67.158.182 on port 443 (TCP); Domain: "www.mybergen.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 172.67.168.155 on port 443 (TCP); Domain: "eddiebrigati.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 66.96.149.1 on port 443 (TCP); Domain: "classicbands.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 151.101.195.52 on port 443 (TCP); Domain: "www.mdc-berlin.de" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 140.82.113.4 on port 443 (TCP); Domain: "github.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 172.67.215.227 on port 443 (TCP); Domain: "makerly.eu" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.11 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 35.213.140.167 on port 443 (TCP); Domain: "vprint3d.com.hk" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 35.190.80.1 on port 443 (UDP)44:Ta02f,"GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: 1c3d.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Thu 05 Nov 2026 08:53:03 GMT Server: cloudflare Cf-Ray: a55aa036ffc24801-SJC Vary: Accept-Encoding X-Frame-Options: DENY Content-Encoding: gzip Permissions-Policy: camera=() microphone=() geolocation=() payment=() usb=() Cf-Cache-Status: HIT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Via: e14s Last-Modified: Sat 16 May 2026 12:40:50 GMT Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://fonts.googleapis.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.gstatic.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https://www.gravatar.com https://secure.gravatar.com https://*.gravatar.com; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'self'; object-src 'none'; X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Referrer-Policy: strict-origin-when-cross-origin Etag: "3c2e-651eea3b0755e" Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=z1Jh75VN%2BZQBEhnnrG6wnsbPiK54uWp1zTOq6ToFCP5EclcsuMT89YPllWHQbMJoaSkAEhLKTXZWJGlsn4ea9vHXvoUARFTaYBiNkiaAsxItxC2kSVVNl7B0BQ%3D%3D"}]} Accept-Ranges: bytes Alt-Svc: h3=":443"; ma=86400 Age: 4049 with response body ==>BINARY_CONTENT....... "GET /favicon?url=filamente.de?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 08:53:02 GMT X-Msedge-Ref: Ref A: 4995E74994C544C3B63BAC93807A15EF Ref B: BY1AA1072318031 Ref C: 2026-11-05T08:53:03Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 4995E74994C544C3B63BAC93807A15EF Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000F_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-2TQTB Ref C: 2026-11-05T08:53:03Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: layercraftlog.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Content-Type: text/html; charset=utf-8 Date: Thu 05 Nov 2026 08:53:03 GMT Server: cloudflare Cf-Ray: a55aa0371a5e9d09-SJC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Vary: rsc next-router-state-tree next-router-prefetch next-router-segment-prefetch Content-Encoding: zstd X-Powered-By: Next.js Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=mABjgsMCc6Kr782fRHb3vVrsDQOR7U9%2BdeZNt5v7n4KMbjd8b1zjeFno0Xj1STZAv5RTdjl6HJ9DTNfcRfAxUi310mpG3HVN5ZgfTagIIJjrKbOZk%2F6BnBeIxUjEFdigsT%2FTPA%3D%3D"}]} Cache-Control: private no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=86400 X-Opennext: 1 with response body ==>BINARY_CONTENT....... "GET /favicon?url=pokershield.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 08:53:02 GMT X-Msedge-Ref: Ref A: 129CDB381E5A4471B7D2B203EB0B2CB9 Ref B: BY1AA1072318031 Ref C: 2026-11-05T08:53:03Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 129CDB381E5A4471B7D2B203EB0B2CB9 Ref B: SC-WUS2-36H23_AKS-GEN01-32749822-VMSS000003_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-VNXJG Ref C: 2026-11-05T08:53:03Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=gamblingnews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 08:53:02 GMT X-Msedge-Ref: Ref A: ADA76F5F69634E519A2707DF604CC0C7 Ref B: BY1AA1072318031 Ref C: 2026-11-05T08:53:03Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: ADA76F5F69634E519A2707DF604CC0C7 Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000C_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-WKG6V Ref C: 2026-11-05T08:53:03Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: clark.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Thu 05 Nov 2026 08:53:03 GMT Server: cloudflare Expires: Wed 29 Sep 2027 12:16:55 GMT Cf-Ray: a55aa03b482515ae-SJC Vary: accept-encoding Host-Header: 8441280b0c35cbc1147f8ba998a563a7 Cf-Cache-Status: HIT Last-Modified: Wed 14 Aug 2024 08:34:23 GMT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} X-Proxy-Cache-Info: DT:1 Etag: "66bc6c0f-0" Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=hYQ9fh4GOudvLMPBL8oZ7H1QIBv5Zykek5s6Sx9kPwzsKGbC7hpG8dqUkLjKjaeZTEFaJSksgwpOo6Qdqtmy2KHAmeWbNBJi3uNBEtfxS0b4bsK%2F0Xzkm6y6cA%3D%3D"}]} Cache-Control: max-age=31536000 Accept-Ranges: bytes Age: 3184568 with no response body "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.goodmoneysense.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Thu 05 Nov 2026 08:53:03 GMT Server: nginx Last-Modified: Sat 25 Aug 2018 12:46:05 GMT Expires: Thu 31 Dec 2037 23:55:55 GMT Etag: "5b814f8d-47e" Cache-Control: max-age=315360000 Accept-Ranges: bytes with no response body "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.fractionalbrandmanagers.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/jpeg Date: Thu 05 Nov 2026 08:53:03 GMT Server: cloudflare Cf-Ray: a55aa03b4e3c67b9-SJC X-Wix-Request-Id: 1793868783.908922489729858796 X-Seen-By: bQAXdg/f3pWGCb3VI6q72A== X-Served-By: SJC Cf-Cache-Status: HIT Strict-Transport-Security: max-age=31556952 Set-Cookie: __cf_bm=FCT__db5tttWX8wlAA.2._nhFVi9YpMBYUNZCLWgZkc-1793868783.89587-1.0.1.1-4LSOdbNBie.vyumps2NlBXe7GxNrQLacnk3bxOik3p8UHwTTuj9vmo03aqnuwhl485OJSEXJEsY5UEw49AruwG.d08pVgmpBatZu1QJMz1E.zLO1e_tC8VZmKn3MKfNi; HttpOnly; SameSite=None; Secure; Path=/; Domain=www.fractionalbrandmanagers.com; Expires=Thu 05 Nov 2026 09:23:03 GMT X-Content-Type-Options: nosniff Etag: W/"1025-5vOo4fE80SpKlp1aWTLPRWYHDIg" Server-Timing: cache;desc=miss varnish;desc=miss_hit dc;desc=cloudflare Accept-Ranges: bytes Cache-Control: public max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=86400 Age: 288364 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.innostation3d.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Date: Thu 05 Nov 2026 08:53:04 GMT X-Request-Id: d4443bb8-176d-45c2-a5bd-21c5036ab54d-1793868784 Server: cloudflare X-Dc: gcp-us-west1 gcp-us-west1 gcp-us-west1 Cf-Ray: a55aa0415cb58b3c-SJC X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen Cf-Cache-Status: DYNAMIC X-Xss-Protection: 1; mode=block Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=qvpa7KgECCrJq4QGiM9q2o%2Fyr87GvwaLxctDQjxPtZVgb146Tmj2%2BqhjVY0nvP7ASvn3gyOxe1LKQtUWRWoaFdb45ACwzIjmJZqXQfoo9vIG2PBKquSME25mNXy27QAw%2Fr%2B%2BSWUjaw%3D%3D"}]} Alt-Svc: h3=":443"; ma=86400 with no response body "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: www.orchestry.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 302 Found Date: Thu 05 Nov 2026 08:53:18 GMT Server: cloudflare Cf-Ray: a55aa0933decd273-SJC X-Hubspot-Correlation-Id: 01a1aae9-9876-772a-97a0-5426fddb27c5 Vary: origin accept-encoding Cf-Cache-Status: DYNAMIC X-Hs-Portal-Id: 7107021 Strict-Transport-Security: max-age=31536000 X-Hs-Cfworker-Meta: {"resolver":"OriginResolver"} Set-Cookie: __cf_bm=8qf9nyuDK0JKo8HvwZxJNZsjJyvhjj1sS6sPDEdBSlo-1793868797.9562507-1.0.1.1-UOZs0mTmnRfFu0e.AxonyYkJFJ3b.9RbvQI4Qz0V9OeePqFEqYcMDd71BXWxWl2qWzP3sXsJ_rMxJGh4EZfs7jZnXaD10Xu5fbzxGJGfQd_Hm074XPcx7mkTafSr2W4b; HttpOnly; SameSite=None; Secure; Path=/; Domain=www.orchestry.com; Expires=Thu 05 Nov 2026 09:23:18 GMT Access-Control-Allow-Credentials: false Content-Security-Policy: upgrade-insecure-requests Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} X-Content-Type-Options: nosniff Location: https://www.orchestry.com/hubfs/Logos/Brand%20Update%202023/Orchestry%20-%20Favicon%20001.png Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=n0MC464pDL0NaA8nD%2BJBbYxoSLzDCUGLfQwfna3BgSFZA2ZOlvg30czd9aW0HociB5diaHiVXNF8Y0t3NvLF%2Bw6TV8R7HeW1CSRG7lBNrcIXNI7nmYh9e5IyEU5tb11d0oh5JhfnTuYHNRSInQ%3D%3D"}]} Server-Timing: hcid;desc="01a1aae9-9876-772a-97a0-5426fddb27c5" cfr;desc="a55aa093ac4ccefd-IAD" Alt-Svc: h3=":443"; ma=86400 with no response body "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: nhimg.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Content-Type: text/html Date: Thu 05 Nov 2026 08:53:18 GMT Server: cloudflare Cf-Ray: a55aa0935f337af7-SJC Vary: Accept-Encoding Content-Encoding: zstd X-Turbo-Charged-By: LiteSpeed Cf-Cache-Status: HIT Strict-Transport-Security: max-age=15552000 Platform: hostinger Last-Modified: Tue 22 Apr 2025 07:57:10 GMT X-Content-Type-Options: nosniff Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=STvuob0i7YScxFDWETkK6kjwMNE5mAUF5Dj6uAEdE1b%2FOIhZ6176cLancJWdnf5uOd92eDM2NyTH8l%2BGF1AcfBd6lcRU7fk6t2ZKomRJewtuXRfDGpJJ8OUEHVM%3D"}]} Panel: hpanel Alt-Svc: h3=":443"; ma=86400 Cache-Control: max-age=86400 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: solvingmicrosoft365.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Date: Thu 05 Nov 2026 08:53:18 GMT Server: cloudflare Cf-Ray: a55aa093ee2115da-SJC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Location: https://www.solvingmicrosoft365.com/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=yWdtbhFHW3zM1yTY%2BBo0j7p2bInVkHDuKyq4PCsnhbj9ybYcoNEL09thKZwJeDYtWyBfvvMLTVIYwexC3V6Mb%2B5v5zhpfZfJmMkUwBdvm2W3yQZMXqwku9Q%2BVK7kX0q7BFVZRekn1v4yNQ%3D%3D"}]} with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C626F6479....... "GET /hubfs/Logos/Brand%20Update%202023/Orchestry%20-%20Favicon%20001.png HTTP/2 Host: www.orchestry.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=8qf9nyuDK0JKo8HvwZxJNZsjJyvhjj1sS6sPDEdBSlo-1793868797.9562507-1.0.1.1-UOZs0mTmnRfFu0e.AxonyYkJFJ3b.9RbvQI4Qz0V9OeePqFEqYcMDd71BXWxWl2qWzP3sXsJ_rMxJGh4EZfs7jZnXaD10Xu5fbzxGJGfQd_Hm074XPcx7mkTafSr2W4b Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 08:53:18 GMT Server: cloudflare Cf-Polished: webp_bigger Edge-Cache-Tag: F-189260401487 FD-124380403049 P-7107021 FLS-ALL Vary: accept-encoding Via: 1.1 207f5507d6d59dcf535e37d1db1f70bc.cloudfront.net (CloudFront) Last-Modified: Wed 23 Apr 2025 18:47:25 GMT Nel: {"report_to":"cf-nel" "success_fraction":0.01 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=bxoiiC60GKBEJjkaoQvieWEWk4Fs7mE0EyeUdEOG1T3d%2BPGnnGaHQf56SLLrfWFgRqr5nna6hztWmPBFU0jDFiAT0BRmHDux4%2BPz0N43BPONgPxv7EoYl0Unf8B45Hsi9xPF"}]} Cache-Control: s-maxage=2592000 max-age=1209600 stale-while-revalidate=900 X-Amz-Cf-Pop: MXP53-P2 Cache-Tag: F-189260401487 FD-124380403049 P-7107021 FLS-ALL Cf-Ray: a55aa0981b88d273-SJC Cf-Cache-Status: HIT Priority: u=4;i=?0 cf-chb=(37;u=3;i=?0 1014;u=5;i=?0) X-Hs-Portal-Id: 7107021 Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Methods: GET X-Hs-Cfworker-Meta: {"resolver":"HubFsResolver"} X-Hs-Alternate-Content-Type: text/plain Access-Control-Allow-Origin: * X-Robots-Tag: all Cf-Bgj: h2pri imgq:85 Etag: "2ffaaa9ad58aea39442a30e9d781da9d" Timing-Allow-Origin: d8fk70yj6xfhx.cloudfront.net X-Cache: Miss from cloudfront Accept-Ranges: bytes Alt-Svc: h3=":443"; ma=86400 Age: 894854 X-Amz-Cf-Id: 3TxRX-HUB21gFujoehMWJm4h-boOI-oRI5UqV4r024CcPci2U-fYug== with response body ==>BINARY_CONTENT....... "GET /favicon?url=note.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 08:53:18 GMT X-Msedge-Ref: Ref A: DA8377DFC1C441BB93D23EE863F9E0BF Ref B: SJC211051203039 Ref C: 2026-11-05T08:53:18Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: DA8377DFC1C441BB93D23EE863F9E0BF Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS00000N_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-CMG74 Ref C: 2026-11-05T08:53:18Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: www.solvingmicrosoft365.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/vnd.microsoft.icon Date: Thu 05 Nov 2026 08:53:18 GMT Server: cloudflare Cf-Ray: a55aa0995fe94900-SJC Vary: accept-encoding X-Frame-Options: SAMEORIGIN Content-Encoding: br Permissions-Policy: camera=() microphone=() geolocation=() interest-cohort=() Cf-Cache-Status: REVALIDATED Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Access-Control-Allow-Origin: * Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Etag: W/"5924136d031d7518c77f1ea2028c86ab" Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Aq1Z%2FBnEBPs3IkwpVdAmxDRFacv52vxkLAVNDRkAt9QOecyS0Ex%2BI%2Fp%2FvRfE%2B%2FwoBSgL8dPRbiJuBEQ3gi0BXaJgTQp%2FxwY%2Fdg7HMx82UAmdP76PUYUVmDNk%2Fcgd7TJXuil0EL4cb2lvKiMI3gSrD4hYMS5QW%2F6mRAk%3D"}]} Cache-Control: public max-age=14400 must-revalidate Alt-Svc: h3=":443"; ma=86400 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: beltsintaekwondo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Content-Type: text/html Date: Thu 05 Nov 2026 08:53:23 GMT Last-Modified: Wed 05 Jan 2022 02:53:34 GMT Server: cloudflare Cf-Ray: a55aa0b24f126cb7-SJC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Vary: Accept-Encoding Content-Encoding: zstd X-Turbo-Charged-By: LiteSpeed Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=A0es%2BmYhHRV3uDCM%2Brp9XGMkwwI5ylYARQfVLseMe%2BNE78xXTFWlnycBQOnNnf9Cht8dety147Q2ra10OMmHp12TDFfsmVMz%2Fwg%2Fq3E12YBTHxr53KmkvZXJH93N8aQFAiqmY9J5Ww%3D%3D"}]} Cf-Cache-Status: MISS Cache-Control: max-age=14400 Alt-Svc: h3=":443"; ma=86400 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: www.taekwondoclasses.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Content-Type: text/html; charset=utf-8 Access-Control-Allow-Origin: * Date: Thu 05 Nov 2026 08:53:22 GMT Last-Modified: Thu 05 Nov 2026 01:03:42 GMT Server: Vercel Content-Disposition: inline; filename="404.html" Content-Encoding: br X-Vercel-Cache: HIT X-Vercel-Id: sfo1::mwbcc-1793868802929-9eac138d3aeb Etag: W/"fda032bd3c4a60271019feee07a678e6" Cache-Control: public max-age=0 must-revalidate Age: 28180 Strict-Transport-Security: max-age=63072000 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: taekwondoking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Thu 05 Nov 2026 08:53:22 GMT Last-Modified: Sun 08 Mar 2026 08:51:43 GMT Server: LiteSpeed Expires: Fri 05 Nov 2027 14:53:22 GMT Vary: User-Agent X-Turbo-Charged-By: LiteSpeed Cache-Control: public max-age=31557600 Accept-Ranges: bytes with response body ==>BINARY_CONTENT....... "GET /favicon?url=gymdesk.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 08:53:22 GMT X-Msedge-Ref: Ref A: E52601C9C90641598445C144BE7C8F3C Ref B: SJC211051203039 Ref C: 2026-11-05T08:53:22Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: E52601C9C90641598445C144BE7C8F3C Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS00000D_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-9QSPL Ref C: 2026-11-05T08:53:23Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: thetaekwondo.app User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Content-Type: text/html; charset=utf-8 Date: Thu 05 Nov 2026 08:53:24 GMT Server: cloudflare Cf-Ray: a55aa0b58bc3c8de-SJC Vary: rsc next-router-state-tree next-router-prefetch next-router-segment-prefetch Accept-Encoding X-Frame-Options: DENY Content-Encoding: zstd Permissions-Policy: camera=() microphone=() geolocation=() payment=() Link: ; rel=preload; as="font"; crossorigin=""; type="font/woff2" ; rel=preload; as="font"; crossorigin=""; type="font/woff2" ; rel=preload; as="font"; crossorigin=""; type="font/woff2" Cf-Cache-Status: BYPASS Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: blob: https://*.tile.openstreetmap.org https://tile.openstreetmap.org; media-src 'self' blob:; worker-src 'self' blob:; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://api.telegram.org https://www.google-analytics.com https://analytics.google.com https://cloudflareinsights.com; frame-src 'self' https://www.youtube-nocookie.com https://www.youtube.com; frame-ancestors 'none' Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Referrer-Policy: strict-origin-when-cross-origin X-Powered-By: Next.js Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=8xBIlZRNYFyPSK%2BH0dxJr4k34I44YQexK2ZGH1DqVtKpDtuqxclfxe0pdx%2By47%2BG7a1Z1kAhRH1%2FNDzo6XqZ%2FGFDwYCKzdWR2RYWs2cQ6eiNoGjEczLbQo6ADPTKJA%2Bavieh"}]} Cache-Control: private no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=86400 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: cybertaekwondo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 302 Found Content-Type: text/html; charset=UTF-8 Date: Thu 05 Nov 2026 08:53:27 GMT X-Httpd-Modphp: 1 Server: nginx X-Redirect-By: WordPress Host-Header: 6b7412fb82ca5edfd0917e3957f05d89 Link: ; rel="https://api.w.org/" Set-Cookie: pmpro_visit=1; path=/; secure; HttpOnly X-Proxy-Cache: MISS X-Proxy-Cache-Info: W302 NC:000000 UP:SKIP_CACHE_SET_COOKIE Referrer-Policy: no-referrer-when-downgrade Location: https://cybertaekwondo.com/wp-content/uploads/2025/01/cropped-cropped-transparent_transparent1-2.png-100x100.webp Cache-Control: no-cache must-revalidate max-age=0 no-store private X-Cache-Enabled: False with no response body "GET /wp-content/uploads/2025/01/cropped-cropped-transparent_transparent1-2.png-100x100.webp HTTP/2 Host: cybertaekwondo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/webp Date: Thu 05 Nov 2026 08:53:27 GMT Server: nginx Last-Modified: Sat 25 Jan 2025 11:44:12 GMT Expires: Fri 05 Nov 2027 08:53:27 GMT Host-Header: 8441280b0c35cbc1147f8ba998a563a7 X-Proxy-Cache-Info: DT:1 Etag: "6794ce8c-c12" Cache-Control: max-age=31536000 Accept-Ranges: bytes with no response body "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: www.mybergen.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Thu 05 Nov 2026 08:53:42 GMT Access-Control-Allow-Origin: * Server: cloudflare Last-Modified: Wed 04 Nov 2026 06:21:19 GMT Set-Cookie: __cf_bm=WY4DjliYWqI4fWnBRLnFHvFNgWEycSnOYpso0hZXNb8-1793868822.3622913-1.0.1.1-Z92QDfnBecloo_GsfuZLobcrGYVC6fDK9lWSnfZhTmSMg4Na3Z74EFNP93RksC4sakGa727mY8IPl7kV45FlVwnaeBCG7KO117kieO2guphsujSBwGNVIiFXA2aq.aNU; HttpOnly; SameSite=None; Secure; Path=/; Domain=www.mybergen.com; Expires=Thu 05 Nov 2026 09:23:42 GMT Cf-Ray: a55aa12bcf31b917-SJC Vary: Accept-Encoding Etag: "6aeacedf-0" Cf-Cache-Status: HIT Cache-Control: public max-age=31536000 Accept-Ranges: bytes Alt-Svc: h3=":443"; ma=86400 with no response body "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: www.mdc-berlin.de User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Content-Type: text/html Date: Thu 05 Nov 2026 08:53:50 GMT Vary: Accept-Encoding Content-Encoding: br X-Timer: S1793868831.759465 VS0 VE149 X-Served-By: cache-fra-etou8220138-FRA cache-lax-kwhp1940081-LAX X-Cache: MISS MISS Accept-Ranges: bytes Alt-Svc: h3=":443";ma=86400 h3-29=":443";ma=86400 h3-27=":443";ma=86400 Age: 0 X-Cache-Hits: 0 0 Strict-Transport-Security: max-age=31557600 with no response body "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: github.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Thu 05 Nov 2026 08:47:42 GMT Server: github.com Expires: Sun 02 Nov 2036 08:47:42 GMT Vary: Accept-Encoding Accept X-Requested-With X-Frame-Options: DENY Content-Encoding: gzip Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Github-Request-Id: C84B:32AD1E:A87DD0:E894FA:6AEC441F Last-Modified: Thu 05 Nov 2026 08:06:09 GMT Set-Cookie: logged_in=no; expires=Fri 05 Nov 2027 07:53:51 GMT; domain=.github.com; path=/; HttpOnly; secure; SameSite=Lax Etag: W/"6aec38f1-1976" Cache-Control: max-age=315360000 Accept-Ranges: bytes X-Github-Edge-Region: iad with no response body "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: makerly.eu User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Content-Type: text/html Date: Thu 05 Nov 2026 08:53:57 GMT Server: cloudflare Cf-Ray: a55aa1845f25cfe9-SJC X-Ray: wnp79677:0.000/wn79677:0.000/ Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Content-Encoding: zstd Cf-Cache-Status: EXPIRED Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=LAaya3ghaRFTwyftroBtfmXQyavTkTBEo27%2BvJrZgd1CIeHSe4WKyb6yanB5z4VRIIPfMm6zxcwraN7F323mrgsoEtxScTIN7huH2VHmKuRgfePiEtNGgH44Lk8Q"}]} Cache-Control: max-age=14400 Speculation-Rules: "/cdn-cgi/speculation" Alt-Svc: h3=":443"; ma=86400 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: vprint3d.com.hk User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 302 Found Content-Type: text/html; charset=UTF-8 Date: Thu 05 Nov 2026 08:53:58 GMT X-Httpd-Modphp: 1 Server: nginx Sg-F-Cache: BYPASS X-Redirect-By: WordPress Host-Header: 6b7412fb82ca5edfd0917e3957f05d89 Link: ; rel="https://api.w.org/" X-Proxy-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block X-Proxy-Cache-Info: 0302 NC:000000 UP: Location: https://vprint3d.com.hk/wp-content/uploads/2026/02/cropped-Logo-S-Clear-scaled-1-32x32.png X-Cache-Enabled: True with no response body "GET /wp-content/uploads/2026/02/cropped-Logo-S-Clear-scaled-1-32x32.png HTTP/2 Host: vprint3d.com.hk User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 08:53:58 GMT Server: nginx Last-Modified: Wed 11 Feb 2026 08:00:19 GMT Expires: Fri 05 Nov 2027 08:53:58 GMT Host-Header: 8441280b0c35cbc1147f8ba998a563a7 X-Proxy-Cache-Info: DT:1 Etag: "698c3713-52b" Cache-Control: max-age=31536000 Accept-Ranges: bytes with no response body45:T5a0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD/klEQVR4Xu2VXWibVRjHX4W2XtjUUtBtxmyKY1tdkV1MZFLwxumtIHqhRRT0QrzRTmjXMbdBQahbgpqVripWL1bDqpurYtOyYbYuH21X1tk0azBpu3xK06Rt+v3x930OnOy8J3mTRtiV/uFHcvImz+85z8mbKMr/2WKi0SgikQjC4TAjFAploDVdI+h9sViMPZ+cnIRcJysXn3wW9wOSe71eTE1NobGxUb+Rzl01+OX5lzT0f3CEIa77Xn0r6316UM1gMAin0wkKNaPbRIfpGZzfWaOBJ+n1oavmUGYduHBJc50if5agmoFAINMARfc4zj2xDz/s3K+BQo9T9iu4ZT7L1vY33kE6FMaN+qbMdT2opjgBHr/fn93EF4/vwbdqxyIU26HDSKgTcJ/8jK3p9WGzlSFG/ixBNakBl8uleS/F5/Npm2jZsRttasciPLe/+T6zpseI04OrHx9l68uvv82QP0tQzYmJCQwNDcFms8FiscBqtcJut2N2dhZjY2P3mmje/jSsxr0aKPKacuvrjpzXZagmnfn4+Di6u7vR3t7OmmhubobZbGa3aaaB49uegkUdWT4uvFaH1n0Hs17Xg2pSA/F4nB0FjX1kZARutxsOh4PdnpkGGh7dhfsB3f8zMzNIJpOMVCqFRCLBfrQ0E6isrER5eXleysrK4PF4GLQL/pwzMDAAx4OluLanGs76TzA6Osp+CUU5nf3c3Bxjfn7+XgNGoxFVVVV5KSkpYSPVg3Y7/EApfB8dgf+0mf0cT09PM3EueTqdzr4dC4XGpweN+k9DFcb2H0D08q8acS75wsJC8Q2QRA8a8+0XXoRbKUX82vWcYlH+rxrg5ynDd3unoQkOpUxXzOWLi4sMuX7BcJEM36234RjsykP4q/VcTjGXLy0tMeT6BcNFInynxO+Gx9Br2o0elZR6q8liUb68vFx8A6JMHvFw43H8bNiGyA0XflIf+998V1dMrKysFN8Al8njTaq7/dGwHYNHTzBp2OnGeXV9seY5+G1dDPexU7jZYkHUM8jkq6urxTfAheJoCbcq7jTtRdjlgavpJC7VHkab8jCjVeWsUo7vTNXoqXtP/aesRrD3KtbW1opvQJTy0YZUqVUVEF21L6O/6RQCPX2Yi8XZqIO9V/Bb3ftoU/+iWxQDLBVGhAdvYn19vfgGxPNMRWPo+7AeZ9SinbWvZM6Wny+HRk3Qjon0dILJNzY2im+Af4nuugfxlTrK0+puiL/v+HNKRTFJuZjY3NwsvgEuOKOO81OlgjHQ3qERilI9MUGR6xcMF5yoMKFBeQR/fP5lllCU6ol55PoFI4vyCUWpLOaR6xeMKMol3IpUjFy/YPLJtioVI9f/7+YfMhfXVn7gbsAAAAAASUVORK5CYII=46:T5a0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD/klEQVR4Xu2VXWibVRjHX4W2XtjUUtBtxmyKY1tdkV1MZFLwxumtIHqhRRT0QrzRTmjXMbdBQahbgpqVripWL1bDqpurYtOyYbYuH21X1tk0azBpu3xK06Rt+v3x930OnOy8J3mTRtiV/uFHcvImz+85z8mbKMr/2WKi0SgikQjC4TAjFAploDVdI+h9sViMPZ+cnIRcJysXn3wW9wOSe71eTE1NobGxUb+Rzl01+OX5lzT0f3CEIa77Xn0r6316UM1gMAin0wkKNaPbRIfpGZzfWaOBJ+n1oavmUGYduHBJc50if5agmoFAINMARfc4zj2xDz/s3K+BQo9T9iu4ZT7L1vY33kE6FMaN+qbMdT2opjgBHr/fn93EF4/vwbdqxyIU26HDSKgTcJ/8jK3p9WGzlSFG/ixBNakBl8uleS/F5/Npm2jZsRttasciPLe/+T6zpseI04OrHx9l68uvv82QP0tQzYmJCQwNDcFms8FiscBqtcJut2N2dhZjY2P3mmje/jSsxr0aKPKacuvrjpzXZagmnfn4+Di6u7vR3t7OmmhubobZbGa3aaaB49uegkUdWT4uvFaH1n0Hs17Xg2pSA/F4nB0FjX1kZARutxsOh4PdnpkGGh7dhfsB3f8zMzNIJpOMVCqFRCLBfrQ0E6isrER5eXleysrK4PF4GLQL/pwzMDAAx4OluLanGs76TzA6Osp+CUU5nf3c3Bxjfn7+XgNGoxFVVVV5KSkpYSPVg3Y7/EApfB8dgf+0mf0cT09PM3EueTqdzr4dC4XGpweN+k9DFcb2H0D08q8acS75wsJC8Q2QRA8a8+0XXoRbKUX82vWcYlH+rxrg5ynDd3unoQkOpUxXzOWLi4sMuX7BcJEM36234RjsykP4q/VcTjGXLy0tMeT6BcNFInynxO+Gx9Br2o0elZR6q8liUb68vFx8A6JMHvFw43H8bNiGyA0XflIf+998V1dMrKysFN8Al8njTaq7/dGwHYNHTzBp2OnGeXV9seY5+G1dDPexU7jZYkHUM8jkq6urxTfAheJoCbcq7jTtRdjlgavpJC7VHkab8jCjVeWsUo7vTNXoqXtP/aesRrD3KtbW1opvQJTy0YZUqVUVEF21L6O/6RQCPX2Yi8XZqIO9V/Bb3ftoU/+iWxQDLBVGhAdvYn19vfgGxPNMRWPo+7AeZ9SinbWvZM6Wny+HRk3Qjon0dILJNzY2im+Af4nuugfxlTrK0+puiL/v+HNKRTFJuZjY3NwsvgEuOKOO81OlgjHQ3qERilI9MUGR6xcMF5yoMKFBeQR/fP5lllCU6ol55PoFI4vyCUWpLOaR6xeMKMol3IpUjFy/YPLJtioVI9f/7+YfMhfXVn7gbsAAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793869224157,"unified_at":"2026-11-05T09:00:24.157Z","metadata":{"hashes":{"sha256":"009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","sha1":"982bf9e5ee4abfcdd6d7d9da5407df58e6e78072","md5":"4162d22d6b6a4290367e6bbce79fcaae","sha512":"a3e6c320efb5edf83f0e1aeca60289d460c8822594eb0dd2881d9547e55b5d4f80383d8c2f15abb9eea2eff722002ebb03790f450a7dbb15f950322769e06715","ssdeep":"6144:UHuF7noF/CXIp9jla1Saf167GarLwjwrwL:Ue7noF/CXInjkTtApiwML","ssdeep_chunks":["6144:UHuF7no","6144:HuF7noF","6144:uF7noF/","6144:F7noF/C","6144:7noF/CX","6144:noF/CXI","6144:oF/CXIp","6144:F/CXIp9","6144:/CXIp9j","6144:CXIp9jl","6144:XIp9jla","6144:Ip9jla1","6144:p9jla1S","6144:9jla1Sa","6144:jla1Saf","6144:la1Saf1","6144:a1Saf16","6144:1Saf167","6144:Saf167G","6144:af167Ga","6144:f167Gar","6144:167GarL","6144:67GarLw","6144:7GarLwj","6144:GarLwjw","6144:arLwjwr","6144:rLwjwrw","6144:LwjwrwL","12288:UHuF7no","12288:HuF7noF","12288:uF7noF/","12288:F7noF/C","12288:7noF/CX","12288:noF/CXI","12288:oF/CXIp","12288:F/CXIp9","12288:/CXIp9j","12288:CXIp9jl","12288:XIp9jla","12288:Ip9jla1","12288:p9jla1S","12288:9jla1Sa","12288:jla1Saf","12288:la1Saf1","12288:a1Saf16","12288:1Saf167","12288:Saf167G","12288:af167Ga","12288:f167Gar","12288:167GarL","12288:67GarLw","12288:7GarLwj","12288:GarLwjw","12288:arLwjwr","12288:rLwjwrw","12288:LwjwrwL","6144:Ue7noF/","6144:e7noF/C","6144:oF/CXIn","6144:F/CXInj","6144:/CXInjk","6144:CXInjkT","6144:XInjkTt","6144:InjkTtA","6144:njkTtAp","6144:jkTtApi","6144:kTtApiw","6144:TtApiwM","6144:tApiwML"],"imphash":"Unknown"},"file_info":{"file_name":"MARS n_2026_15_Saison IRA 2026-27.pdf","file_type":["pdf"],"file_type_id":"pdf","file_size":205689,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793868625000,"last_seen":1793868625000,"last_multi_scan":1793868625000},"additional_metadata":[{"name":"pdf","type":"obj","values":[{"name":"encrypted","type":"bool","values":[false]},{"name":"version","type":"str","values":["1.7"]},{"name":"page_count","type":"int","values":[5]},{"name":"info","type":"obj","values":[{"name":"author","type":"str","values":["OSTAPOWICZ, Marine (DICOM/MULTIMEDIA ET EVENEMENTIEL)"]},{"name":"producer","type":"str","values":["Microsoft® Word pour Microsoft 365"]},{"name":"mod_date","type":"str","values":["D:20261104164201+01'00'"]},{"name":"creation_date","type":"str","values":["D:20261104164201+01'00'"]},{"name":"creator","type":"str","values":["Microsoft® Word pour Microsoft 365"]}]},{"name":"uris","type":"array","values":["https://odisse.santepubliquefrance.fr/bulletin-ira/","https://sante.gouv.fr/IMG/pdf/dgs-urgent_no2026-10_campagne_vrs_2026.pdf","https://sante.gouv.fr/IMG/pdf/reply_dgs-urgent_n2026_12_campagne_grippe_covid-19_2026.pdf","https://odisse.santepubliquefrance.fr/bulletin-ira/","https://solidarites.gouv.fr/recommandations-sanitaires-conduite-tenir-dans-les-esm-face-aux-ira","https://solidarites.gouv.fr/recommandations-sanitaires-conduite-tenir-dans-les-esm-face-aux-ira","https://solidarites.gouv.fr/recommandations-sanitaires-conduite-tenir-dans-les-esm-face-aux-ira"]}]}]},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["malicious","suspicious"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":49},"sandbox_signatures":{"informative_count":87,"suspicious_count":9,"malicious_count":4,"total":100},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Initial Access","technique":"Spearphishing Link","attack_id":"T1566.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1566/002","identifiers":[{"type":"informative","value":"PDF file has an embedded URL"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"},{"type":"suspicious","value":"Application communicates to suspicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"},{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Discovery","technique":"Cloud Service Dashboard","attack_id":"T1538","attack_id_wiki":"https://attack.mitre.org/techniques/T1538","identifiers":[{"type":"informative","value":"Able to retrieve cloud service dashboard"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains an object with compressed stream data"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Able to download payload via Wget"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"malicious","value":"GETs files from a web server (Office documents)"},{"type":"suspicious","value":"Contacts random domain names"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Tries to GET non-existent files from a web server"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"suspicious","value":"Contacts GitHub domains (possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"},{"type":"malicious","value":"Detected multiple DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","identifiers":[{"type":"suspicious","value":"Shows ability to use external web service to exfiltrate data"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://sante.gouv.fr/img/pdf/dgs-urgent_no2026-10_campagne_vrs_2026.pdf\", Pattern match: \"https://odisse.santepubliquefrance.fr/bulletin-ira/\", Pattern match: \"http://www.w3.org/1999/02/22-rdf-syntax-ns#\", Pattern match: \"https://solidarites.gouv.fr/recommandations-sanitaires-conduite-tenir-dans-les-esm-face-aux-ira\", Pattern match: \"http://purl.org/dc/elements/1.1/\", Heuristic match: \"0 .sb\", Pattern match: \"http://ns.adobe.com/xap/1.0/mm/\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://sante.gouv.fr\", Found HTTPS url \"https://odisse.santepubliquefrance.fr\", Found HTTPS url \"https://solidarites.gouv.fr\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"Windows.Security.Cryptography.Core.HashAlgorithmProvider\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00001120.00000000.146834.43079000.00000004.mdmp, 00000000-00001120.00000001.148464.43079000.00000004.mdmp\")\n Found reference to \"Windows.Security.Cryptography.Core.HashAlgorithmNames\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00001120.00000000.146834.43079000.00000004.mdmp, 00000000-00001120.00000001.148464.43079000.00000004.mdmp\")\n Found reference to \"Windows.Security.Cryptography.Core.HashAlgorithmProviderer\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00001120.00000000.146834.43079000.00000004.mdmp, 00000000-00001120.00000001.148464.43079000.00000004.mdmp\")\n Found reference to \"RC2V\" (Indicator: \"RC2\"; Source: \"00000000-00001120.00000000.146834.46200000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - PE_NAME=\\\\.\\pi; Source: \"00000000-00001120.00000000.146834.43100000.00000004.mdmp, 00000000-00001120.00000001.148464.43100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at B8900000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"AcroRd32.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"AcroRd32.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"msedge.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"identity_helper.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\POLICYMANAGER\\DEFAULT\\PRIVACY\\LETAPPSRUNINBACKGROUND_FORCEDENYTHESEAPPS\")\n \"identity_helper.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\POLICYMANAGER\\DEFAULT\\PRIVACY\\LETAPPSRUNINBACKGROUND\")\n \"identity_helper.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\POLICYMANAGER\\DEFAULT\\PRIVACY\\LETAPPSRUNINBACKGROUND\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"identity_helper.exe\" queried SystemProcessInformation at 00000000-00001120-00000C15-890645021 [PID: 1120]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00001120-00000C15-890653250 [PID: 1120]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00001120-00000C15-890871485 [PID: 1120]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00001120-00000C15-890890471 [PID: 1120]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00001120-00000C15-893027669 [PID: 1120]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00001120-00000C15-893037912 [PID: 1120]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \".decrypt\"; File: \"urlref_httpssolidarites.gouv.frrecommandations-sanitaires-conduite-tenir-dans-les-esm-face-aux-ira\")\n file/memory contains long string with (Indicator: \"fromcharcode\"; File: \"urlref_httpssolidarites.gouv.frrecommandations-sanitaires-conduite-tenir-dans-les-esm-face-aux-ira\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.87675","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"github.com\" (Indicator: \"github.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"identity_helper.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001120)\n \"identity_helper.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00001120)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"AcroRd32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00008744)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"identity_helper.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001120)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"identity_helper.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"identity_helper.exe\" queried token user identity (UID: 00000000-00001120)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/23 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"1c3d.com\"\n \"services.bingapis.com\"\n \"layercraftlog.com\"\n \"clark.com\"\n \"www.goodmoneysense.com\"\n \"www.fractionalbrandmanagers.com\"\n \"www.innostation3d.com\"\n \"www.orchestry.com\"\n \"nhimg.org\"\n \"solvingmicrosoft365.com\"\n \"www.solvingmicrosoft365.com\"\n \"beltsintaekwondo.com\"\n \"www.taekwondoclasses.net\"\n \"taekwondoking.com\"\n \"thetaekwondo.app\"\n \"cybertaekwondo.com\"\n \"www.mybergen.com\"\n \"www.mdc-berlin.de\"\n \"github.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"13.32.241.52:443\"\n \"150.171.74.13:443\"\n \"172.67.149.17:443\"\n \"172.67.221.69:443\"\n \"107.181.241.146:443\"\n \"104.24.88.18:443\"\n \"172.66.3.8:443\"\n \"23.227.38.74:443\"\n \"185.242.134.76:443\"\n \"199.60.103.2:443\"\n \"172.67.171.129:443\"\n \"199.60.103.2\"\n \"172.67.149.17\"\n \"172.67.215.75:443\"\n \"172.67.221.69\"\n \"104.21.24.12:443\"\n \"104.21.24.12\"\n \"172.67.211.221:443\"\n \"68.65.120.151:443\"\n \"76.76.21.98:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Contains an object with compressed stream data","description":"$2a","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":10,"id":"static-66","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$2c","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"addressbook.acrodata\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"A9Rsgesa1_14b2inr_6qw.tmp\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - EDGE_CRASHPAD_PIPE_NAME=\\\\.\\pipe\\crashpad_9212_WRSWQDVGQAUIWPZL","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$2d","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"msedge.exe\" (UID: 00000000-00009212)\n Launches browser \"msedge.exe\" (UID: 00000000-00005020)\n Launches browser \"msedge.exe\" (UID: 00000000-00007644)\n Launches browser \"msedge.exe\" (UID: 00000000-00005332)\n Launches browser \"msedge.exe\" (UID: 00000000-00006812)\n Launches browser \"msedge.exe\" (UID: 00000000-00008824)\n Launches browser \"msedge.exe\" (UID: 00000000-00008476)\n Launches browser \"msedge.exe\" (UID: 00000000-00008536)\n Launches browser \"msedge.exe\" (UID: 00000000-00003368)\n Launches browser \"msedge.exe\" (UID: 00000000-00008140)\n Launches browser \"msedge.exe\" (UID: 00000000-00005348)\n Launches browser \"msedge.exe\" (UID: 00000000-00004612)\n Launches browser \"msedge.exe\" (UID: 00000000-00001656)\n Launches browser \"msedge.exe\" (UID: 00000000-00005516)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at C3D40000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at C3D70000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at C4630000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a309c4f97f0000@ntdll.dll\"\n \"220023000000000038a309c4f97f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"MARS n_2026_15_Saison IRA 2026-27.pdf\" was detected as \"PDF\" and name: \"Format\"\n \"MARS n_2026_15_Saison IRA 2026-27.pdf\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"identity_helper.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"identity_helper.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\\TREATAS\")\n \"identity_helper.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")\n \"identity_helper.exe\" touched \"Property System Apartment Class Factory\" (Path: \"HKCU\\CLSID\\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}\\TREATAS\")\n \"identity_helper.exe\" touched \"ShellItem Shell Namespace helper\" (Path: \"HKCU\\CLSID\\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\\TREATAS\")\n \"identity_helper.exe\" touched \"Windows Search Manager\" (Path: \"HKCU\\CLSID\\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\\TREATAS\")\n \"identity_helper.exe\" touched \"Windows Push Notification Developer Proxy Stub\" (Path: \"HKCU\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"PDF file has an embedded URL","description":"\"https://sante.gouv.fr/IMG/pdf/reply_dgs-urgent_n2026_12_campagne_grippe_covid-19_2026.pdf\" (Based on: \"MARS n_2026_15_Saison IRA 2026-27.pdf\")\n \"https://solidarites.gouv.fr/recommandations-sanitaires-conduite-tenir-dans-les-esm-face-aux-ira\" (Based on: \"MARS n_2026_15_Saison IRA 2026-27.pdf\")\n \"https://odisse.santepubliquefrance.fr/bulletin-ira/\" (Based on: \"MARS n_2026_15_Saison IRA 2026-27.pdf\")\n \"https://sante.gouv.fr/IMG/pdf/dgs-urgent_no2026-10_campagne_vrs_2026.pdf\" (Based on: \"MARS n_2026_15_Saison IRA 2026-27.pdf\")","origin":"File/Memory","mitre_attack_id":"T1566.002","relevance":3,"id":"string-25","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$2f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"1c3d.com\"\n \"3dx.info\"\n \"beltsintaekwondo.com\"\n \"clark.com\"\n \"classicbands.com\"\n \"clients2.googleusercontent.com\"\n \"cybertaekwondo.com\"\n \"eddiebrigati.com\"\n \"edge-consumer-static.azureedge.net\"\n \"github.com\"\n \"layercraftlog.com\"\n \"makerly.eu\"\n \"nhimg.org\"\n \"r.msftstatic.com\"\n \"sb.scorecardresearch.com\"\n \"services.bingapis.com\"\n \"solvingmicrosoft365.com\"\n \"taekwondoking.com\"\n \"thetaekwondo.app\"\n \"vprint3d.com.hk\"\n \"www.fractionalbrandmanagers.com\"\n \"www.goodmoneysense.com\"\n \"www.innostation3d.com\"\n \"www.mdc-berlin.de\"\n \"www.mybergen.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$30","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$31","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$32","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a web server","description":"$33","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"identity_helper.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$34","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"A9Rma6bkw_14b2int_6qw.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rma6bkw_14b2int_6qw.tmp]\n \"A9R7k2rkc_14b2ins_6qw.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9R7k2rkc_14b2ins_6qw.tmp]\n \"A9R9202th_14b2inu_6qw.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9R9202th_14b2inu_6qw.tmp]\n \"FAPDC1C.tmp\" has type \"ASCII text with no line terminators\" - Location: [%TEMP%\\FAPDC1C.tmp]\n \"A9Rsgesa1_14b2inr_6qw.tmp\" has type \"data\" - Location: [%TEMP%\\A9Rsgesa1_14b2inr_6qw.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"AcroRd32.exe\" opens a process \"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (UID: 00000000-00008744)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"identity_helper.exe\" queries basic process information of the \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe\" (UID: 1120)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00001120.00000000.146834.430C6000.00000004.mdmp, 00000000-00001120.00000001.148464.430C6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"identity_helper.exe\" trying to touch file \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge_elf.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\msedge_elf.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\dbghelp.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\dbghelp.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\Windows\\System32\\dbghelp.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\dbghelp.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\WINMM.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\WINMM.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\Windows\\System32\\winmm.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\WINMM.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"identity_helper.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\LocalState\\ToastCollectionIcons\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssi.dat\"\n \"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annss.dat\"\n \"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssk.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"Able to download payload via Wget","description":"file/memory contains long string(Source: \"00000000-00001120.00000000.146834.463E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-963","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve cloud service dashboard","description":"file/memory contains long string(Source: \"00000000-00001120.00000000.146834.463E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1538","relevance":1,"id":"string-777","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=filamente.de?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=pokershield.org?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=gamblingnews.com?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t\"\n Found http requests in header \"GET /hubfs/Logos/Brand%20Update%202023/Orchestry%20-%20Favicon%20001.png\"\n Found http requests in header \"GET /favicon?url=note.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t\"\n Found http requests in header \"GET /favicon?url=gymdesk.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t\"\n Found http requests in header \"GET /wp-content/uploads/2025/01/cropped-cropped-transparent_transparent1-2.png-100x100.webp\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"mx._\" [Source: 00000000-00001120.00000000.146834.46200000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$3a","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$3b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"services.bingapis.com\" has high entropy\n Contacted domain: \"www.fractionalbrandmanagers.com\" has high entropy\n Contacted domain: \"solvingmicrosoft365.com\" has high entropy\n Contacted domain: \"www.solvingmicrosoft365.com\" has high entropy\n Contacted domain: \"beltsintaekwondo.com\" has high entropy\n Contacted domain: \"taekwondoking.com\" has high entropy\n Contacted domain: \"cybertaekwondo.com\" has high entropy\n Contacted domain: \"vprint3d.com.hk\" has high entropy\n Contacted domain: \"clients2.googleusercontent.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"1c3d.com\" (1 days old)\n Newly renewed or created SSL certificate: \"github.com\" (6 days old)\n Newly renewed or created SSL certificate: \"www.mdc-berlin.de\" (3 days old)\n Newly renewed or created SSL certificate: \"www.orchestry.com\" (11 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$3c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"$3d","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"13.32.241.52\" on port \"443\"\n HTTPS traffic to \"150.171.74.13\" on port \"443\"\n HTTPS traffic to \"172.67.149.17\" on port \"443\"\n HTTPS traffic to \"172.67.221.69\" on port \"443\"\n HTTPS traffic to \"107.181.241.146\" on port \"443\"\n HTTPS traffic to \"104.24.88.18\" on port \"443\"\n HTTPS traffic to \"172.66.3.8\" on port \"443\"\n HTTPS traffic to \"23.227.38.74\" on port \"443\"\n HTTPS traffic to \"185.242.134.76\" on port \"443\"\n HTTPS traffic to \"199.60.103.2\" on port \"443\"\n HTTPS traffic to \"172.67.171.129\" on port \"443\"\n HTTPS traffic to \"172.67.215.75\" on port \"443\"\n HTTPS traffic to \"104.21.24.12\" on port \"443\"\n HTTPS traffic to \"172.67.211.221\" on port \"443\"\n HTTPS traffic to \"68.65.120.151\" on port \"443\"\n HTTPS traffic to \"76.76.21.98\" on port \"443\"\n HTTPS traffic to \"104.21.32.85\" on port \"443\"\n HTTPS traffic to \"35.212.84.29\" on port \"443\"\n HTTPS traffic to \"142.251.218.129\" on port \"443\"\n HTTPS traffic to \"172.67.158.182\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--profile-directory=Default\" (Indicator: \"--profile-directory=\"; File: \"msedge.exe\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"AcroRd32.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 754C0000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"identity_helper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"identity_helper.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \".decrypt\"; File: \"urlref_httpssolidarites.gouv.frrecommandations-sanitaires-conduite-tenir-dans-les-esm-face-aux-ira\")\n file/memory contains long string with (Indicator: \"base64\"; File: \"urlref_httpssolidarites.gouv.frrecommandations-sanitaires-conduite-tenir-dans-les-esm-face-aux-ira\")\n Found string \"Z?aEsN\" (Indicator: \"aes\"; Source: \"00000000-00001120.00000000.146834.46200000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"base64\"; Source: \"00000000-00001120.00000000.146834.463E0000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"ecdsa\"; Source: \"00000000-00001120.00000000.146834.463E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$40","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"msedge.exe\" opened \"\\Device\\KsecDD\"\n \"identity_helper.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains embedded objects that may warrant investigation","description":"Embedded object type \"/ObjStm\" (ID: 98, References: )","origin":"Static Parser","relevance":5,"id":"static-10","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$41","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"file/memory contains long string with (Indicator: \"process monitor\"; Source: \"00000000-00001120.00000000.146834.463E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 172.67.149.17\"\n \"UDP connection to 172.67.221.69\"\n \"UDP connection to 199.60.103.2\"\n \"UDP connection to 104.21.24.12\"\n \"UDP connection to 172.67.211.221\"\n \"UDP connection to 172.67.158.182\"\n \"UDP connection to 172.67.215.227\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"suspicious","category":"Network Related","name":"Application communicates to suspicious domain","description":"Contacted Domain: \"1c3d.com\" has been identified as suspicious\n Contacted Domain: \"goodmoneysense.com\" has been identified as suspicious\n Contacted Domain: \"nhimg.org\" has been identified as suspicious\n Contacted Domain: \"solvingmicrosoft365.com\" has been identified as suspicious\n Contacted Domain: \"beltsintaekwondo.com\" has been identified as suspicious\n Contacted Domain: \"taekwondoking.com\" has been identified as suspicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-89","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"suspicious","category":"Network Related","name":"Contacts GitHub domains (possible C&C communication)","description":"\"github.com\"","origin":"Network Traffic","mitre_attack_id":"T1102","relevance":5,"id":"network-70","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"suspicious","category":"Network Related","name":"Contacts random domain names","description":"\"vprint3d.com.hk\" seems to be random","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"suspicious","category":"Network Related","name":"Shows ability to use external web service to exfiltrate data","description":"The analysis shows possible data exfiltration using popular external web services. Matched sigs: Contacts GitHub domains (possible C&C communication)","origin":"Indicator Combinations","mitre_attack_id":"T1567","relevance":1,"id":"summary-37","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"$43","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"malicious","category":"General","name":"GETs files from a web server (Office documents)","description":"$44","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-16","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"innostation3d.com\" has been identified as malicious\n Contacted Domain: \"thetaekwondo.app\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"malicious","category":"Network Related","name":"Detected multiple DNS responses with a low TTL","description":"\"1c3d.com\" with TTL 300\n \"beltsintaekwondo.com\" with TTL 300\n \"clark.com\" with TTL 300\n \"clients2.googleusercontent.com\" with TTL 300\n \"eddiebrigati.com\" with TTL 300\n \"edge-consumer-static.azureedge.net\" with TTL 32\n \"github.com\" with TTL 60\n \"layercraftlog.com\" with TTL 300\n \"makerly.eu\" with TTL 300\n \"nhimg.org\" with TTL 300\n \"sb.scorecardresearch.com\" with TTL 60\n \"services.bingapis.com\" with TTL 37\n \"solvingmicrosoft365.com\" with TTL 300\n \"thetaekwondo.app\" with TTL 300\n \"www.innostation3d.com\" with TTL 154\n \"www.mybergen.com\" with TTL 300\n \"www.orchestry.com\" with TTL 119\n \"www.solvingmicrosoft365.com\" with TTL 300\n \"www.taekwondoclasses.net\" with TTL 300","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Document analysis contacts a domain","description":"Often seen on documents with macro droppers\n embedded files or exploits","origin":"Indicator Combinations","relevance":3,"id":"summary-1","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected multiple DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 28 domains and 28 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]}],"intel_graph":{"map":{"Domain:1c3d.com":{"type":"Domain","value":"1c3d.com"},"Domain:3dx.info":{"type":"Domain","value":"3dx.info"},"Domain:beltsintaekwondo.com":{"type":"Domain","value":"beltsintaekwondo.com"},"Domain:clark.com":{"type":"Domain","value":"clark.com"},"Domain:classicbands.com":{"type":"Domain","value":"classicbands.com"},"Domain:clients2.googleusercontent.com":{"type":"Domain","value":"clients2.googleusercontent.com"},"Domain:cybertaekwondo.com":{"type":"Domain","value":"cybertaekwondo.com"},"Domain:eddiebrigati.com":{"type":"Domain","value":"eddiebrigati.com"},"Domain:edge-consumer-static.azureedge.net":{"type":"Domain","value":"edge-consumer-static.azureedge.net"},"Domain:github.com":{"type":"Domain","value":"github.com"},"Domain:layercraftlog.com":{"type":"Domain","value":"layercraftlog.com"},"Domain:makerly.eu":{"type":"Domain","value":"makerly.eu"},"Domain:nhimg.org":{"type":"Domain","value":"nhimg.org"},"Domain:r.msftstatic.com":{"type":"Domain","value":"r.msftstatic.com"},"Domain:sb.scorecardresearch.com":{"type":"Domain","value":"sb.scorecardresearch.com"},"Domain:services.bingapis.com":{"type":"Domain","value":"services.bingapis.com"},"Domain:solvingmicrosoft365.com":{"type":"Domain","value":"solvingmicrosoft365.com"},"Domain:taekwondoking.com":{"type":"Domain","value":"taekwondoking.com"},"Domain:thetaekwondo.app":{"type":"Domain","value":"thetaekwondo.app"},"Domain:vprint3d.com.hk":{"type":"Domain","value":"vprint3d.com.hk"},"Domain:www.fractionalbrandmanagers.com":{"type":"Domain","value":"www.fractionalbrandmanagers.com"},"Domain:www.goodmoneysense.com":{"type":"Domain","value":"www.goodmoneysense.com"},"Domain:www.innostation3d.com":{"type":"Domain","value":"www.innostation3d.com"},"Domain:www.mdc-berlin.de":{"type":"Domain","value":"www.mdc-berlin.de"},"Domain:www.mybergen.com":{"type":"Domain","value":"www.mybergen.com"},"Domain:www.orchestry.com":{"type":"Domain","value":"www.orchestry.com"},"Domain:www.solvingmicrosoft365.com":{"type":"Domain","value":"www.solvingmicrosoft365.com"},"Domain:www.taekwondoclasses.net":{"type":"Domain","value":"www.taekwondoclasses.net"},"File:006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1":{"type":"File","value":"006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1"},"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe":{"type":"File","value":"009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe"},"File:3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60":{"type":"File","value":"3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60"},"File:480a65a9ecdce607d84f75ce80f6dad6197ab981e4fd3323ca5003374000483d":{"type":"File","value":"480a65a9ecdce607d84f75ce80f6dad6197ab981e4fd3323ca5003374000483d"},"File:574efe952fb6ccdee94af7f13d08d1d02f6940d6806b9fd7e999972dcabde2ad":{"type":"File","value":"574efe952fb6ccdee94af7f13d08d1d02f6940d6806b9fd7e999972dcabde2ad"},"File:5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68":{"type":"File","value":"5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68"},"File:5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975":{"type":"File","value":"5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975"},"File:679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e":{"type":"File","value":"679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e"},"File:86a09a64e5875373c0d16c5f1d380cebe423bb2c0167c75cb3d30f6d7b1cee85":{"type":"File","value":"86a09a64e5875373c0d16c5f1d380cebe423bb2c0167c75cb3d30f6d7b1cee85"},"File:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08":{"type":"File","value":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"},"File:d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3":{"type":"File","value":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3"},"File:d996500df12bd54cf70bda6b5d8acd56bc3905d57f0dcdde6419fed16af0a6fa":{"type":"File","value":"d996500df12bd54cf70bda6b5d8acd56bc3905d57f0dcdde6419fed16af0a6fa"},"File:f1e5df16bfa4a1b078353f17ac09ff4b9bab9a16ce6ae91df911cb30c1b1e09c":{"type":"File","value":"f1e5df16bfa4a1b078353f17ac09ff4b9bab9a16ce6ae91df911cb30c1b1e09c"},"File:f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71":{"type":"File","value":"f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71"},"File:fa5fdebe80ec0ce7dc40738b4fd46a9e9b36eca6a810c523ee6ef3fd40b4179e":{"type":"File","value":"fa5fdebe80ec0ce7dc40738b4fd46a9e9b36eca6a810c523ee6ef3fd40b4179e"},"Ip:104.21.24.12":{"type":"Ip","value":"104.21.24.12"},"Ip:104.21.32.85":{"type":"Ip","value":"104.21.32.85"},"Ip:104.24.88.18":{"type":"Ip","value":"104.24.88.18"},"Ip:107.181.241.146":{"type":"Ip","value":"107.181.241.146"},"Ip:13.32.241.52":{"type":"Ip","value":"13.32.241.52"},"Ip:140.82.113.4":{"type":"Ip","value":"140.82.113.4"},"Ip:142.251.218.129":{"type":"Ip","value":"142.251.218.129"},"Ip:150.171.110.7":{"type":"Ip","value":"150.171.110.7"},"Ip:150.171.27.10":{"type":"Ip","value":"150.171.27.10"},"Ip:150.171.74.13":{"type":"Ip","value":"150.171.74.13"},"Ip:151.101.195.52":{"type":"Ip","value":"151.101.195.52"},"Ip:172.66.3.8":{"type":"Ip","value":"172.66.3.8"},"Ip:172.67.149.17":{"type":"Ip","value":"172.67.149.17"},"Ip:172.67.158.182":{"type":"Ip","value":"172.67.158.182"},"Ip:172.67.168.155":{"type":"Ip","value":"172.67.168.155"},"Ip:172.67.171.129":{"type":"Ip","value":"172.67.171.129"},"Ip:172.67.211.221":{"type":"Ip","value":"172.67.211.221"},"Ip:172.67.215.227":{"type":"Ip","value":"172.67.215.227"},"Ip:172.67.215.75":{"type":"Ip","value":"172.67.215.75"},"Ip:172.67.221.69":{"type":"Ip","value":"172.67.221.69"},"Ip:185.242.134.76":{"type":"Ip","value":"185.242.134.76"},"Ip:199.60.103.2":{"type":"Ip","value":"199.60.103.2"},"Ip:23.227.38.74":{"type":"Ip","value":"23.227.38.74"},"Ip:35.190.80.1":{"type":"Ip","value":"35.190.80.1"},"Ip:35.212.84.29":{"type":"Ip","value":"35.212.84.29"},"Ip:35.213.140.167":{"type":"Ip","value":"35.213.140.167"},"Ip:66.96.149.1":{"type":"Ip","value":"66.96.149.1"},"Ip:68.65.120.151":{"type":"Ip","value":"68.65.120.151"},"Ip:76.76.21.98":{"type":"Ip","value":"76.76.21.98"},"Url:/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t":{"type":"Url","value":"/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"},"Url:/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=filamente.de?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=filamente.de?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=gamblingnews.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=gamblingnews.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=gymdesk.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t":{"type":"Url","value":"/favicon?url=gymdesk.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"},"Url:/favicon?url=note.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t":{"type":"Url","value":"/favicon?url=note.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"},"Url:/favicon?url=pokershield.org?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=pokershield.org?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/hubfs/Logos/Brand%20Update%202023/Orchestry%20-%20Favicon%20001.png":{"type":"Url","value":"/hubfs/Logos/Brand%20Update%202023/Orchestry%20-%20Favicon%20001.png"},"Url:/wp-content/uploads/2025/01/cropped-cropped-transparent_transparent1-2.png-100x100.webp":{"type":"Url","value":"/wp-content/uploads/2025/01/cropped-cropped-transparent_transparent1-2.png-100x100.webp"},"Url:/wp-content/uploads/2026/02/cropped-Logo-S-Clear-scaled-1-32x32.png":{"type":"Url","value":"/wp-content/uploads/2026/02/cropped-Logo-S-Clear-scaled-1-32x32.png"}},"chains":[{"id":"sandbox_network","root":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","edges":[{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:13.32.241.52"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:150.171.74.13"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:172.67.149.17"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:172.67.221.69"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:107.181.241.146"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:104.24.88.18"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:172.66.3.8"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:23.227.38.74"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:185.242.134.76"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:199.60.103.2"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:172.67.171.129"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:199.60.103.2"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:172.67.149.17"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:172.67.215.75"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:172.67.221.69"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:104.21.24.12"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:104.21.24.12"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:172.67.211.221"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:68.65.120.151"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:76.76.21.98"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:104.21.32.85"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:35.212.84.29"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:142.251.218.129"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:172.67.211.221"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:172.67.158.182"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:172.67.168.155"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:66.96.149.1"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:151.101.195.52"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:140.82.113.4"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:172.67.215.227"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:172.67.158.182"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:35.213.140.167"},{"edge_kind":"contacted_ip","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Ip:35.190.80.1"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:1c3d.com"},{"edge_kind":"resolves_to","from_key":"Domain:1c3d.com","to_key":"Ip:172.67.149.17"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:3dx.info"},{"edge_kind":"resolves_to","from_key":"Domain:3dx.info","to_key":"Ip:185.242.134.76"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:beltsintaekwondo.com"},{"edge_kind":"resolves_to","from_key":"Domain:beltsintaekwondo.com","to_key":"Ip:172.67.211.221"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:clark.com"},{"edge_kind":"resolves_to","from_key":"Domain:clark.com","to_key":"Ip:104.24.88.18"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:classicbands.com"},{"edge_kind":"resolves_to","from_key":"Domain:classicbands.com","to_key":"Ip:66.96.149.1"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:clients2.googleusercontent.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.googleusercontent.com","to_key":"Ip:142.251.218.129"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:cybertaekwondo.com"},{"edge_kind":"resolves_to","from_key":"Domain:cybertaekwondo.com","to_key":"Ip:35.212.84.29"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:eddiebrigati.com"},{"edge_kind":"resolves_to","from_key":"Domain:eddiebrigati.com","to_key":"Ip:172.67.168.155"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:edge-consumer-static.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edge-consumer-static.azureedge.net","to_key":"Ip:150.171.110.7"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:github.com"},{"edge_kind":"resolves_to","from_key":"Domain:github.com","to_key":"Ip:140.82.113.4"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:layercraftlog.com"},{"edge_kind":"resolves_to","from_key":"Domain:layercraftlog.com","to_key":"Ip:172.67.221.69"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:makerly.eu"},{"edge_kind":"resolves_to","from_key":"Domain:makerly.eu","to_key":"Ip:172.67.215.227"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:nhimg.org"},{"edge_kind":"resolves_to","from_key":"Domain:nhimg.org","to_key":"Ip:172.67.171.129"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:r.msftstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:r.msftstatic.com","to_key":"Ip:150.171.27.10"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:sb.scorecardresearch.com"},{"edge_kind":"resolves_to","from_key":"Domain:sb.scorecardresearch.com","to_key":"Ip:13.32.241.52"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:services.bingapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:services.bingapis.com","to_key":"Ip:150.171.74.13"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:solvingmicrosoft365.com"},{"edge_kind":"resolves_to","from_key":"Domain:solvingmicrosoft365.com","to_key":"Ip:172.67.215.75"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:taekwondoking.com"},{"edge_kind":"resolves_to","from_key":"Domain:taekwondoking.com","to_key":"Ip:68.65.120.151"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:thetaekwondo.app"},{"edge_kind":"resolves_to","from_key":"Domain:thetaekwondo.app","to_key":"Ip:104.21.32.85"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:vprint3d.com.hk"},{"edge_kind":"resolves_to","from_key":"Domain:vprint3d.com.hk","to_key":"Ip:35.213.140.167"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:www.fractionalbrandmanagers.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.fractionalbrandmanagers.com","to_key":"Ip:172.66.3.8"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:www.goodmoneysense.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.goodmoneysense.com","to_key":"Ip:107.181.241.146"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:www.innostation3d.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.innostation3d.com","to_key":"Ip:23.227.38.74"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:www.mdc-berlin.de"},{"edge_kind":"resolves_to","from_key":"Domain:www.mdc-berlin.de","to_key":"Ip:151.101.195.52"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:www.mybergen.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.mybergen.com","to_key":"Ip:172.67.158.182"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:www.orchestry.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.orchestry.com","to_key":"Ip:199.60.103.2"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:www.solvingmicrosoft365.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.solvingmicrosoft365.com","to_key":"Ip:172.67.215.75"},{"edge_kind":"contacted_domain","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Domain:www.taekwondoclasses.net"},{"edge_kind":"resolves_to","from_key":"Domain:www.taekwondoclasses.net","to_key":"Ip:76.76.21.98"},{"edge_kind":"contacted_url","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Url:/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Url:/favicon?url=filamente.de?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Url:/favicon?url=pokershield.org?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Url:/favicon?url=gamblingnews.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Url:/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"},{"edge_kind":"contacted_url","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Url:/hubfs/Logos/Brand%20Update%202023/Orchestry%20-%20Favicon%20001.png"},{"edge_kind":"contacted_url","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Url:/favicon?url=note.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"},{"edge_kind":"contacted_url","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Url:/favicon?url=gymdesk.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"},{"edge_kind":"contacted_url","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Url:/wp-content/uploads/2025/01/cropped-cropped-transparent_transparent1-2.png-100x100.webp"},{"edge_kind":"contacted_url","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"Url:/wp-content/uploads/2026/02/cropped-Logo-S-Clear-scaled-1-32x32.png"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","edges":[{"edge_kind":"extracted","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"File:679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e"},{"edge_kind":"extracted","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"File:679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e"},{"edge_kind":"extracted","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"File:574efe952fb6ccdee94af7f13d08d1d02f6940d6806b9fd7e999972dcabde2ad"},{"edge_kind":"extracted","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"File:d996500df12bd54cf70bda6b5d8acd56bc3905d57f0dcdde6419fed16af0a6fa"},{"edge_kind":"extracted","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"File:f1e5df16bfa4a1b078353f17ac09ff4b9bab9a16ce6ae91df911cb30c1b1e09c"},{"edge_kind":"extracted","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"File:d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3"},{"edge_kind":"extracted","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"File:f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71"},{"edge_kind":"extracted","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"File:5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68"},{"edge_kind":"extracted","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"File:006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1"},{"edge_kind":"extracted","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"File:5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975"},{"edge_kind":"extracted","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"File:3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60"},{"edge_kind":"extracted","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"File:fa5fdebe80ec0ce7dc40738b4fd46a9e9b36eca6a810c523ee6ef3fd40b4179e"},{"edge_kind":"extracted","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"File:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"},{"edge_kind":"extracted","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"File:86a09a64e5875373c0d16c5f1d380cebe423bb2c0167c75cb3d30f6d7b1cee85"},{"edge_kind":"extracted","from_key":"File:009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe","to_key":"File:480a65a9ecdce607d84f75ce80f6dad6197ab981e4fd3323ca5003374000483d"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":17,"spawned_processes_count":17,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":102,"imported_dlls_count":238,"dropped_files_count":0,"extracted_files_count":15,"files_written_count":38,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":33,"dns_resolutions_count":28,"contacted_urls_count":10,"http_requests_count":10},"behavior_tags":["malicious","suspicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6aec435036412886f609d442","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["CAN","POL","SGP","USA"],"submit_name":"MARS n_2026_15_Saison IRA 2026-27.pdf","analysis_start_time":"2026-11-05T08:50:25+00:00","indicators_count":{"informative":87,"suspicious":13,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"13.32.241.52","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"150.171.74.13","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"172.67.149.17","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"172.67.221.69","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"107.181.241.146","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"104.24.88.18","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"172.66.3.8","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"23.227.38.74","port":443,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"185.242.134.76","port":443,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"199.60.103.2","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"172.67.171.129","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"199.60.103.2","port":0,"protocol":"ICMP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"172.67.149.17","port":0,"protocol":"ICMP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"172.67.215.75","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"172.67.221.69","port":0,"protocol":"ICMP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"104.21.24.12","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"104.21.24.12","port":0,"protocol":"ICMP","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"172.67.211.221","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"68.65.120.151","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"76.76.21.98","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"104.21.32.85","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"35.212.84.29","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"142.251.218.129","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"172.67.211.221","port":0,"protocol":"ICMP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"172.67.158.182","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"172.67.168.155","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"66.96.149.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"151.101.195.52","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"140.82.113.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"172.67.215.227","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"172.67.158.182","port":0,"protocol":"ICMP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"35.213.140.167","port":443,"protocol":"TCP","country":"Singapore","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"address":"35.190.80.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]}],"dns_resolutions":[{"domain":"1c3d.com","address":"172.67.149.17","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"3dx.info","address":"185.242.134.76","ttl":3600,"country":"Poland","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"beltsintaekwondo.com","address":"172.67.211.221","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"clark.com","address":"104.24.88.18","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"classicbands.com","address":"66.96.149.1","ttl":3600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"clients2.googleusercontent.com","address":"142.251.218.129","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"cybertaekwondo.com","address":"35.212.84.29","ttl":20426,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"eddiebrigati.com","address":"172.67.168.155","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"edge-consumer-static.azureedge.net","address":"150.171.110.7","ttl":32,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"github.com","address":"140.82.113.4","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"layercraftlog.com","address":"172.67.221.69","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"makerly.eu","address":"172.67.215.227","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"nhimg.org","address":"172.67.171.129","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"r.msftstatic.com","address":"150.171.27.10","ttl":2186,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"sb.scorecardresearch.com","address":"13.32.241.52","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"services.bingapis.com","address":"150.171.74.13","ttl":37,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"solvingmicrosoft365.com","address":"172.67.215.75","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"taekwondoking.com","address":"68.65.120.151","ttl":1200,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"thetaekwondo.app","address":"104.21.32.85","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"vprint3d.com.hk","address":"35.213.140.167","ttl":3600,"country":"Singapore","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"www.fractionalbrandmanagers.com","address":"172.66.3.8","ttl":966,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"www.goodmoneysense.com","address":"107.181.241.146","ttl":600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"www.innostation3d.com","address":"23.227.38.74","ttl":154,"country":"Canada","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"www.mdc-berlin.de","address":"151.101.195.52","ttl":3188,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"www.mybergen.com","address":"172.67.158.182","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"www.orchestry.com","address":"199.60.103.2","ttl":119,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"www.solvingmicrosoft365.com","address":"172.67.215.75","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"domain":"www.taekwondoclasses.net","address":"76.76.21.98","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]}],"http_requests":[{"host":"1c3d.com","host_ip":"172.67.149.17:443","url":"/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: 1c3d.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=filamente.de?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=filamente.de?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=pokershield.org?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=pokershield.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=gamblingnews.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=gamblingnews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"host":"www.orchestry.com","host_ip":"199.60.103.2:443","url":"/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2\nHost: www.orchestry.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"host":"www.orchestry.com","host_ip":"199.60.103.2:443","url":"/hubfs/Logos/Brand%20Update%202023/Orchestry%20-%20Favicon%20001.png","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hubfs/Logos/Brand%20Update%202023/Orchestry%20-%20Favicon%20001.png HTTP/2\nHost: www.orchestry.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: __cf_bm=8qf9nyuDK0JKo8HvwZxJNZsjJyvhjj1sS6sPDEdBSlo-1793868797.9562507-1.0.1.1-UOZs0mTmnRfFu0e.AxonyYkJFJ3b.9RbvQI4Qz0V9OeePqFEqYcMDd71BXWxWl2qWzP3sXsJ_rMxJGh4EZfs7jZnXaD10Xu5fbzxGJGfQd_Hm074XPcx7mkTafSr2W4b\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=note.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=note.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=gymdesk.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=gymdesk.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"host":"cybertaekwondo.com","host_ip":"35.212.84.29:443","url":"/wp-content/uploads/2025/01/cropped-cropped-transparent_transparent1-2.png-100x100.webp","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/uploads/2025/01/cropped-cropped-transparent_transparent1-2.png-100x100.webp HTTP/2\nHost: cybertaekwondo.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"host":"vprint3d.com.hk","host_ip":"35.213.140.167:443","url":"/wp-content/uploads/2026/02/cropped-Logo-S-Clear-scaled-1-32x32.png","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/uploads/2026/02/cropped-Logo-S-Clear-scaled-1-32x32.png HTTP/2\nHost: vprint3d.com.hk\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}],"processes":[{"pid":8744,"ppid":0,"name":"AcroRd32.exe","command_line":"\"C:\\MARSn_2026_15_SaisonIRA2026-27.pdf\"","sha256":"c43c0929e1f9b27dac07d49b0a659e83be4cdb4dfdd709eb7e37a341cd169e87","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","uid":"00000000-00008744","icon":"$45"},{"pid":9212,"ppid":0,"name":"msedge.exe","command_line":"--profile-directory=Default","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00009212","icon":"$46"},{"pid":5020,"ppid":9212,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7ff99c070f18,0x7ff99c070f24,0x7ff99c070f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009212","uid":"00000000-00005020"},{"pid":7644,"ppid":9212,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1804,i,4416670711596730803,4250498448629242830,262144 --field-trial-handle=2248,i,3561215224109990161,7395885837182898613,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2196 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009212","uid":"00000000-00007644"},{"pid":5332,"ppid":9212,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1980,i,1919350626552447344,7630157565592914440,524288 --field-trial-handle=2248,i,3561215224109990161,7395885837182898613,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2304 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009212","uid":"00000000-00005332"},{"pid":6812,"ppid":9212,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2436,i,14808191712787625880,4348301046595311757,524288 --field-trial-handle=2248,i,3561215224109990161,7395885837182898613,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2632 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009212","uid":"00000000-00006812"},{"pid":8824,"ppid":9212,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1793866502251029 --launch-time-ticks=2269659638 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3520,i,6208580236660961438,10379021433001048817,2097152 --field-trial-handle=2248,i,3561215224109990161,7395885837182898613,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3560 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009212","uid":"00000000-00008824"},{"pid":8476,"ppid":9212,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1793866502251029 --launch-time-ticks=2269695955 --skip-read-main-dll --metrics-shmem-handle=3528,i,18014923293723522646,9183314049709266170,2097152 --field-trial-handle=2248,i,3561215224109990161,7395885837182898613,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3572 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009212","uid":"00000000-00008476"},{"pid":8536,"ppid":9212,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=3688,i,6812012189163724783,7611683545037597615,524288 --field-trial-handle=2248,i,3561215224109990161,7395885837182898613,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5432 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009212","uid":"00000000-00008536"},{"pid":3368,"ppid":9212,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5224,i,16002493342331407614,11184110863817098983,524288 --field-trial-handle=2248,i,3561215224109990161,7395885837182898613,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5492 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009212","uid":"00000000-00003368"},{"pid":5148,"ppid":9212,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6188,i,17305533445920459966,11825317209750412463,524288 --field-trial-handle=2248,i,3561215224109990161,7395885837182898613,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=6208 /prefetch:8","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00009212","uid":"00000000-00005148"},{"pid":1120,"ppid":9212,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6188,i,17305533445920459966,11825317209750412463,524288 --field-trial-handle=2248,i,3561215224109990161,7395885837182898613,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=6208 /prefetch:8","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00009212","uid":"00000000-00001120"},{"pid":8140,"ppid":9212,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=3740,i,15990641072447003051,6849875231056110635,524288 --field-trial-handle=2248,i,3561215224109990161,7395885837182898613,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5232 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009212","uid":"00000000-00008140"},{"pid":5348,"ppid":9212,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3272,i,9315502922376510678,15272813485876800778,524288 --field-trial-handle=2248,i,3561215224109990161,7395885837182898613,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3296 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009212","uid":"00000000-00005348"},{"pid":4612,"ppid":9212,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=4936,i,3786256073815897285,15218932335832777361,524288 --field-trial-handle=2248,i,3561215224109990161,7395885837182898613,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6816 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009212","uid":"00000000-00004612"},{"pid":1656,"ppid":9212,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=6936,i,17704100064710279906,8285887459639382495,524288 --field-trial-handle=2248,i,3561215224109990161,7395885837182898613,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=3316 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009212","uid":"00000000-00001656"},{"pid":5516,"ppid":9212,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=6016,i,8543834076162404061,9921116906151570834,524288 --field-trial-handle=2248,i,3561215224109990161,7395885837182898613,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6472 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009212","uid":"00000000-00005516"}],"all_imported_dlls":["rpcrt4.dll","BIB.dll","Windows.Storage.ApplicationData.dll","uxtheme.dll","coloradapterclient.dll","cryptsp.dll","directmanipulation.dll","capauthz.dll","wevtapi.dll","SHCore.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","ResourcePolicyClient.dll","wscapi.dll","shell32.dll","msedge_elf.dll","microsoft_shell_integration.dll","ncryptprov.dll","sspicli.dll","dnsapi.dll","ntdll.dll","advapi32.dll","oneds.dll","TenantRestrictionsPlugin.dll","AppXDeploymentClient.dll","user32.dll","imm32.dll","cryptbase.dll","propsys.dll","sqlite.dll","coml2.dll","winsta.dll","Windows.Storage.Search.dll","wlanapi.dll","Windows.ApplicationModel.dll","crypt32.dll","schannel.dll","webauthn.dll","well_known_domains.dll","Windows.Networking.Connectivity.dll","libGLESv2.dll","d3d10warp.dll","DataExchange.dll","samcli.dll","ole32.dll","WinTypes.dll","IPHLPAPI.DLL","SystemSettings.DataModel.dll","wow64win.dll","windows.storage.dll","winnsi.dll","WindowManagementAPI.dll","sppc.dll","StartTileData.dll","mpr.dll","TextShaping.dll","wtsapi32.dll","fwbase.dll","dusmapi.dll","ncrypt.dll","BitsProxy.dll","ACE.dll","ccme_asym.dll","ntasn1.dll","UserMgrProxy.dll","netutils.dll","MMDevAPI.dll","WindowsCodecs.dll","omadmapi.dll","oneauth.dll","wow64.dll","rsaenh.dll","comdlg32.dll","thumbcache.dll","ShellCommonCommonProxyStub.dll","kernel.appcore.dll","msctf.dll","linkinfo.dll","msacm32.dll","CoreUIComponents.dll","DXCore.dll","msvcp140.dll","winmm.dll","userenv.dll","AXSLE.dll","oleacc.dll","BCP47Langs.dll","BIBUtils.dll","psapi.dll","Windows.Devices.Enumeration.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","TileDataRepository.dll","dsound.dll","atlthunk.dll","mf.dll","cfgmgr32.dll","vk_swiftshader.dll","wow64cpu.dll","AcGenral.dll","srvcli.dll","sxs.dll","TextInputFramework.dll","ksuser.dll","npmproxy.dll","dwmapi.dll","CoolType.dll","twinapi.appcore.dll","GdiPlus.dll","nsi.dll","gpapi.dll","OneCoreUAPCommonProxyStub.dll","libEGL.dll","CryptoWinRT.dll","dmcmnutils.dll","DWrite.dll","ffmpeg.dll","KernelBase.dll","msvcp100.dll","d3d11.dll","ws2_32.dll","ieframe.dll","slc.dll","netapi32.dll","powrprof.dll","KBDUS.DLL","biwinrt.dll","RTWorkQ.dll","gdi32full.dll","msvcp_win.dll","ucrtbase.dll","setupapi.dll","Windows.System.Profile.RetailInfo.dll","mfplat.dll","fltLib.dll","ExecModelClient.dll","AXE8SharedExpat.dll","ccme_ecdrbg.dll","Windows.Web.dll","slwga.dll","oleaut32.dll","winmmbase.dll","avrt.dll","OneCoreCommonProxyStub.dll","d3dcompiler_47.dll","VxSSL64.dll","StructuredQuery.dll","Windows.StateRepository.dll","msvcr100.dll","msvcp110_win.dll","OnDemandConnRouteHelper.dll","Geolocation.dll","msasn1.dll","mdmregistration.dll","AdobeXMP.dll","xmllite.dll","rmclient.dll","mswsock.dll","FWPUCLNT.DLL","Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll","bcrypt.dll","AssignedAccessRuntime.dll","wpnapps.dll","iertutil.dll","profapi.dll","CoreMessaging.dll","devobj.dll","mscms.dll","edputil.dll","vaultcli.dll","FirewallAPI.dll","shlwapi.dll","version.dll","NPSWF32.dll","ccme_base_non_fips.dll","twinapi.dll","Windows.StateRepositoryPS.dll","Windows.Security.Authentication.Web.Core.dll","StateRepository.Core.dll","kernel32.dll","win32u.dll","comctl32.dll","dsreg.dll","Windows.UI.Immersive.dll","vcruntime140_1.dll","ntmarta.dll","SensApi.dll","wsock32.dll","usermgrcli.dll","Windows.StateRepositoryCore.dll","PCPKsp.dll","msvcrt.dll","gdi32.dll","combase.dll","AcroRd32.dll","wininet.dll","msimg32.dll","InputHost.dll","winhttp.dll","mlang.dll","dhcpcsvc.dll","AGM.dll","wintrust.dll","ccme_base.dll","ccme_ecc.dll","MicrosoftAccountWAMExtension.dll","netprofm.dll","policymanager.dll","dpapi.dll","nlaapi.dll","dbghelp.dll","wldp.dll","dcomp.dll","dxgi.dll","umpdc.dll","onnxruntime.dll","bcryptprimitives.dll","wkscli.dll","secur32.dll","rasadhlp.dll","PCShellCommonProxyStub.dll","urlmon.dll","Windows.UI.dll","telclient.dll","domain_actions.dll","vcruntime140.dll","aadWamExtension.dll","tbs.dll","Windows.Internal.Shell.Broker.dll","apphelp.dll","sechost.dll","clbcatq.dll","cryptocme.dll","msedge.dll","Windows.Internal.UI.Shell.WindowTabManager.dll","LocationFrameworkPS.dll","execmodelproxy.dll","dhcpcsvc6.dll","CapabilityAccessManagerClient.dll","imagehlp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"addressbook.acrodata","sha256":"679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"A9Rsgesa1_14b2inr_6qw.tmp","sha256":"679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Annss.dat","sha256":"574efe952fb6ccdee94af7f13d08d1d02f6940d6806b9fd7e999972dcabde2ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Annssi.dat","sha256":"d996500df12bd54cf70bda6b5d8acd56bc3905d57f0dcdde6419fed16af0a6fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Annssk.dat","sha256":"f1e5df16bfa4a1b078353f17ac09ff4b9bab9a16ce6ae91df911cb30c1b1e09c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl","sha256":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sha256":"f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl","sha256":"006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"A9R7k2rkc_14b2ins_6qw.tmp","sha256":"5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"A9R9202th_14b2inu_6qw.tmp","sha256":"3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"A9Rma6bkw_14b2int_6qw.tmp","sha256":"fa5fdebe80ec0ce7dc40738b4fd46a9e9b36eca6a810c523ee6ef3fd40b4179e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"FAPDC1C.tmp","sha256":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"urlref_httpsodisse.santepubliquefrance.frbulletin-ira","sha256":"86a09a64e5875373c0d16c5f1d380cebe423bb2c0167c75cb3d30f6d7b1cee85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"urlref_httpssolidarites.gouv.frrecommandations-sanitaires-conduite-tenir-dans-les-esm-face-aux-ira","sha256":"480a65a9ecdce607d84f75ce80f6dad6197ab981e4fd3323ca5003374000483d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]}],"files_written":[{"path":"pipe\\GmdAslLogger","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"%TEMP%\\FAPDC1C.tmp","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages-journal","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\UserCache.bin","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\crashpad_9212_WRSWQDVGQAUIWPZL","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.8692.13579988941191501815","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.8692.16967010387775456368","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.8692.12840817909410482252","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.8692.5976891784235615371","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.8692.12573610408379127819","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.7228.3887953871673552762","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.7228.2973815711606676932","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.7228.8864589359554493750","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.7228.511287228375353445","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.7228.12596781302244631523","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.7228.6975418750126122246","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.7228.8158467224050069497","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.8692.11601056734856144007","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.8692.12692463368654561279","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.7228.4307962536943402567","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.4232.207231477035398510","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.7228.7278739066310331005","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.8692.3987086673979505853","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.8692.7896461555804072837","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.8692.18142397231513976309","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.9212.8692.5997395768816245168","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"pipe\\LOCAL\\mojo.8824.5740.5009412288449636228","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8744:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8744:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8744:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DirectSound DllMain mutex (0x00002228)","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"SM0:8744:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Local\\SM0:8744:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"SM0:8744:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"DirectSound DllMain mutex (0x00002228)","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCEICHICCCAAAA","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCEICHICCCAAAA","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9212:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Local\\SM0:9212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Local\\SM0:9212:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"SM0:9212:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"SM0:9212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9212:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Local\\SM0:5020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"SM0:5020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7644:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7644:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Local\\SM0:7644:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"SM0:7644:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5332:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"SM0:5332:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Local\\SM0:5332:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5332:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6812:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"SM0:6812:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\AppContainerNamedObjects\\S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-924012159-129201922\\SM0:8824:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8536:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"SM0:8536:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Local\\SM0:1120:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Local\\SM0:1120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"SM0:1120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"SM0:1120:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1120:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1120:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Local\\SM0:8140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"SM0:8140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"SM0:1656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5516:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"Local\\SM0:5516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"SM0:5516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]},{"name":"SM0:5516:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aec435036412886f609d442"}]}]}},"report_ids":{"sandbox_job_ids":["6aec435036412886f609d442"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample 009192a8e02b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 009192a8e02b…. Threat score 100/100. 0/24 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 009192a8e02b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 009192a8e02b…. Threat score 100/100. 0/24 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/009192a8e02baceb8930a90c2e0154117c971e42698facbe5db3755868ee9cbe"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 009192a8e02b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 009192a8e02b…. Threat score 100/100. 0/24 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L47","11",{}]]