23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T425,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 2555ccb012b3… — Score 76/100 — Hybrid Analysis","description":"Malicious verdict for sample 2555ccb012b3…. Threat score 76/100. 0/5 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2555ccb012b304e6b60596ba602f18d4d942c4d50fc623d77742cbe6d1f9e80b","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","2555ccb012b304e6b60596ba602f18d4d942c4d50fc623d77742cbe6d1f9e80b"],"about":{"@type":"SoftwareApplication","name":"http://login.microsoftonline.com/","applicationCategory":["url"],"identifier":"2555ccb012b304e6b60596ba602f18d4d942c4d50fc623d77742cbe6d1f9e80b","additionalType":"Malicious sample"},"threatScore":76,"antivirusDetections":{"malicious":0,"total":5},"behavioralIndicators":{"malicious":4,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T702,"microsoft_logo[1].svg" has type "HTML document ASCII text with very long lines with no line terminators" "urlblockindex[1].bin" has type "data" "info[1].svg" has type "ASCII text with CRLF line terminators" "ellipsis_grey[1].svg" has type "HTML document ASCII text with very long lines with no line terminators" "ellipsis_white[1].svg" has type "HTML document ASCII text with very long lines with no line terminators" "urlref_httplogin.microsoftonline.com" has type "HTML document ASCII text with CRLF line terminators" "6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04" has type "data" "boot.worldwide.mouse[1].css" has type "ASCII text with very long lines with no line terminators" "boot.worldwide.3.mouse[1].js" has type "UTF-8 Unicode (with BOM) text with very long lines with CRLF line terminators" "favicon[1].ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "aria-eae6c86d[1].js" has type "ASCII text with very long lines with no line terminators" "RecoveryStore.{2F3BB043-8E8E-11E8-9C24-0A0027C19E6D}.dat" has type "Composite Document File V2 Document Cannot read section info" "boot.worldwide.0.mouse[1].js" has type "UTF-8 Unicode (with BOM) text with very long lines with CRLF line terminators" "prefetch[1].htm" has type "HTML document ASCII text with CRLF line terminators" "TK2QR769.txt" has type "ASCII text" "MS3D2DNZ.txt" has type "ASCII text" "search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "B398B80134F72209547439DB21AB308D_592839A8569F831D0F2306AE4BB5C24B" has type "data" "favicon[3].ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data 6509 bytes 1 file"25:T3a52,Pattern match: "http://login.microsoftonline.com/" Pattern match: "http://login.microsoftonline.com" Pattern match: "http://192.168.56.151:2869/upnphost/udhisapi.dll?content=uuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56" Pattern match: "http://[fe80::8d8d:12f:f3a3:d4a9]:2869/upnphost/udhisapi.dll?content=uuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56" Heuristic match: "login.microsoftonline.com" Heuristic match: "loginex.microsoftonline.com" Heuristic match: "login2.microsoftonline.com" Pattern match: "mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%204.crl" Pattern match: "crl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%204.crl0" Pattern match: "www.microsoft.com/pki/mscorp/Microsoft%20IT%20TLS%20CA%204.crt0" Pattern match: "http://ocsp.msocsp.com0" Pattern match: "http://www.microsoft.com/pki/mscorp/cps0" Pattern match: "http://ocsp.digicert.com0" Pattern match: "http://crl3.digicert.com/Omniroot2025.crl0=" Pattern match: "https://www.digicert.com/CPS0" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b51f5eaa3187625d HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 20 Apr 2017 16:02:20 GMTIf-None-Match: 04e707defb9d21:0User-Agent: Microsoft-CryptoAPI/6.1Hos" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d2a62781b86b6dd4 HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 20 Apr 2017 16:02:20 GMTIf-None-Match: 04e707defb9d21:0User-Agent: Microsoft-CryptoAPI/6.1Hos" Pattern match: "www.bing.com" Pattern match: "www.bing.com0" Pattern match: "mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%205.crl" Pattern match: "crl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%205.crl0" Pattern match: "www.microsoft.com/pki/mscorp/Microsoft%20IT%20TLS%20CA%205.crt0" Heuristic match: "dict.bing.com.cn" Heuristic match: "*.platform.bing.com" Heuristic match: "*.bing.com" Heuristic match: "*.windowssearch.com" Heuristic match: "*.origin.bing.com" Heuristic match: "*.mm.bing.net" Heuristic match: "pi.bing.com" Heuristic match: "ecn.dev.virtualearth.net" Heuristic match: "*.cn.bing.net" Heuristic match: "*.cn.bing.com" Heuristic match: "ssl-api.bing.com" Heuristic match: "ssl-api.bing.net" Heuristic match: "*.api.bing.net" Heuristic match: "*.bingapis.com" Heuristic match: "bingsandbox.com" Heuristic match: "insertmedia.bing.office.net" Heuristic match: "r.bat.bing.com" Heuristic match: "*.r.bat.bing.com" Heuristic match: "*.dict.bing.com.cn" Heuristic match: "*.dict.bing.com" Heuristic match: "*.ssl.bing.com" Heuristic match: "*.appex.bing.com" Heuristic match: "*.platform.cn.bing.com" Heuristic match: "wp.m.bing.com" Heuristic match: "*.m.bing.com" Heuristic match: "global.bing.com" Heuristic match: "windowssearch.com" Heuristic match: "search.msn.com" Heuristic match: "*.bingsandbox.com" Heuristic match: "*.api.tiles.ditu.live.com" Heuristic match: "*.ditu.live.com" Heuristic match: "*.t0.tiles.ditu.live.com" Heuristic match: "*.t1.tiles.ditu.live.com" Heuristic match: "*.t2.tiles.ditu.live.com" Heuristic match: "*.t3.tiles.ditu.live.com" Heuristic match: "*.tiles.ditu.live.com" Heuristic match: "3d.live.com" Heuristic match: "api.search.live.com" Heuristic match: "beta.search.live.com" Heuristic match: "cnweb.search.live.com" Heuristic match: "dev.live.com" Heuristic match: "ditu.live.com" Heuristic match: "farecast.live.com" Heuristic match: "image.live.com" Heuristic match: "images.live.com" Heuristic match: "local.live.com.au" Heuristic match: "localsearch.live.com" Heuristic match: "ls4d.search.live.com" Heuristic match: "mail.live.com" Heuristic match: "mapindia.live.com" Heuristic match: "local.live.com" Heuristic match: "maps.live.com" Heuristic match: "maps.live.com.au" Heuristic match: "mindia.live.com" Heuristic match: "news.live.com" Heuristic match: "origin.cnweb.search.live.com" Heuristic match: "preview.local.live.com" Heuristic match: "search.live.com" Heuristic match: "test.maps.live.com" Heuristic match: "video.live.com" Heuristic match: "videos.live.com" Heuristic match: "virtualearth.live.com" Heuristic match: "wap.live.com" Heuristic match: "webmaster.live.com" Heuristic match: "webmasters.live.com" Pattern match: "www.local.live.com.au" Pattern match: "www.maps.live.com.au0" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?383108223eafdce0 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bb589ed6069b6fb8 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAtqs7A%2Bsan2xGCSaqjN%2FrM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQirwAcgHViBybgyJMa7KdCHDISOgQUenuMwc%2FnoMoc1Gv6%2B%2BEzww8aop0CExYAAH514kLvoKYKHpgAAAAAfnU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.msocsp.com" Pattern match: "www.office.com" Heuristic match: "account.office.com" Heuristic match: "account.office.net" Heuristic match: "account-sdf.office.com" Heuristic match: "admin.office.com" Heuristic match: "auth.microsoftonline.com" Heuristic match: "auth.office.com" Heuristic match: "auth-sdf.microsoftonline.com" Heuristic match: "h-sdf.office.com" Heuristic match: "easauth.office.com" Heuristic match: "easportal.office.com" Heuristic match: "ejpauth.office.com" Heuristic match: "ejpportal.office.com" Heuristic match: "eusauth.office.com" Heuristic match: "eusportal.office.com" Heuristic match: "home.office.com" Heuristic match: "iwprod.msocdn.com" Heuristic match: "ncuauth.office.com" Heuristic match: "ncuauthprv.office.com" Heuristic match: "ncuportal.office.com" Heuristic match: "ncuportalprv.office.com" Heuristic match: "nukauth.office.com" Heuristic match: "ncuprodprv.msocdn.com" Heuristic match: "nukportal.office.com" Heuristic match: "office.com" Heuristic match: "officehome.msocdn.com" Heuristic match: "portal.microsoftonline.com" Heuristic match: "portal.office.com" Heuristic match: "portalprv.microsoftonline.com" Heuristic match: "portal-sdf.office.com" Heuristic match: "prod.aeon.msocdn.com" Heuristic match: "prod.flux.msocdn.com" Heuristic match: "prod.msocdn.com" Heuristic match: "scuauth.office.com" Heuristic match: "scuauthprv.office.com" Heuristic match: "scuportal.office.com" Heuristic match: "scuportalprv.office.com" Heuristic match: "scuprodprv.msocdn.com" Heuristic match: "seaauth.office.com" Heuristic match: "seaportal.office.com" Heuristic match: "sukauth.office.com" Heuristic match: "sukportal.office.com" Heuristic match: "weuauth.office.com" Heuristic match: "weuportal.office.com" Heuristic match: "wusauth.office.com" Heuristic match: "wusauthprv.office.com" Heuristic match: "wusportal.office.com" Heuristic match: "wusportalprv.office.com" Heuristic match: "wusprodprv.msocdn.com" Heuristic match: "#secure.aadcdn.microsoftonline-p.com" Pattern match: "mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl" Pattern match: "crl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl0" Pattern match: "www.microsoft.com/pki/mscorp/Microsoft%20IT%20TLS%20CA%201.crt0" Heuristic match: "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAACaxjdTSTTmzWEcAAAAAJrE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.msocsp.com" Heuristic match: "suk.officehome.msocdn.com" Heuristic match: "vc84;H .pG" Heuristic match: "outlook.office365.com" Heuristic match: "*.clo.footprintdns.com" Heuristic match: "*.nrb.footprintdns.com" Heuristic match: "*.hotmail.com" Heuristic match: "*.internal.outlook.com" Heuristic match: "*.live.com" Heuristic match: "*.office.com" Heuristic match: "*.office365.com" Heuristic match: "*.outlook.com" Heuristic match: "*.outlook.office365.com" Heuristic match: "attachment.outlook.live.net" Heuristic match: "attachment.outlook.office.net" Heuristic match: "attachment.outlook.officeppe.net" Heuristic match: "ccs.login.microsoftonline.com" Heuristic match: "!ccs-sdf.login.microsoftonline.com" Heuristic match: "hotmail.com" Heuristic match: "mail.services.live.com" Heuristic match: "office365.com" Heuristic match: "outlook.com" Heuristic match: "outlook.office.com" Heuristic match: "substrate.office.com" Pattern match: "crl3.digicert.com/DigiCertCloudServicesCA-1-g1.crl0" Pattern match: "crl4.digicert.com/DigiCertCloudServicesCA-1-g1.crl0L" Pattern match: "https://www.digi" Pattern match: "cert.com/CPS0" Pattern match: "http://ocspx.digicert.com0E" Pattern match: "cacerts.digicert.com/DigiCertCloudServicesCA-1.crt0" Pattern match: "www.digicert.com1" Pattern match: "crl4.digicert.com/DigiCertGlobalRootCA.crl07" Pattern match: "crl3.digicert.com/DigiCertGlobalRootCA.crl0=" Heuristic match: "admin.onedrive.com" Heuristic match: "*.live.net" Heuristic match: "*.odwebb.svc.ms" Heuristic match: "*.odwebp.svc.ms" Heuristic match: "*.onedrive.com" Heuristic match: "*.onedrive.live.com" Heuristic match: "*.sharept.ms" Heuristic match: "*.skydrive.live.com" Heuristic match: "d.sfx-df.ms" Heuristic match: "onedrive.com" Heuristic match: "sharept.ms" Pattern match: "www.groups.live.com" Pattern match: "www.photos.live.com0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAGewca9P1l7sgwzOOVR2Hc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "spoprod-a.akamaihd.net" Heuristic match: "a248.e.akamai.net" Heuristic match: "*.akamaihd-staging.net" Heuristic match: "*.akamaized.net" Heuristic match: "*.akamaihd.net" Pattern match: "http://crl3.digicert.com/ssca-ecc-g1.crl0" Pattern match: "http://crl4.digicert.com/ssca-ecc-g1.crl0L" Pattern match: "http://ocsp.digicert.com0E" Pattern match: "cacerts.digicert.com/DigiCertECCSecureServerCA.crt0" Pattern match: "http://ocsp.digicert.com0B" Heuristic match: "r4.res.office365.com" Heuristic match: "*.res.outlook.com" Heuristic match: "*.res.live.com" Heuristic match: "*.res.office365.com" Heuristic match: "*.res.office.com" Heuristic match: "*.res.exchangelabs.com" Pattern match: "http://www.microsoft.c" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEArLKLpGXuU5CHZ0cPPNxhI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTnvAI%2FnN49qPTJY2qTQtfkLxjvEAQUo53mH%2FnaOU%2FAbuiRy5Wl2jHiCp8CEAHU1tIRV0LZhVOuZBfdVxI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "pipe.skype.com" Heuristic match: "*.vo.msecnd.net" Heuristic match: "*.adn.azureedge.net" Heuristic match: "*.ads2.msads.net" Heuristic match: "*.aspnetcdn.com" Heuristic match: "*.azurecomcdn.net" Heuristic match: "*.azureedge.net" Heuristic match: "*.azureedge-test.net" Heuristic match: "*.cdn.skype.com" Heuristic match: "*.cdn.skype.net" Heuristic match: "*.cmsresources.windowsphone.com" Heuristic match: "#*.cmsresources.windowsphone-int.com" Heuristic match: "*.dev.skype.com" Heuristic match: "*.fms.azureedge.net" Heuristic match: "*.microsoft-sbs-domains.com" Heuristic match: "*.secure.skypeassets.com" Heuristic match: "*.secure.skypeassets.net" Heuristic match: "*.wac.azureedge.net" Heuristic match: "*.wpc.azureedge.net" Heuristic match: "*.ec.azureedge.net" Heuristic match: "*.wpc.ec.azureedge.net" Heuristic match: "*.wac.ec.azureedge.net" Heuristic match: "*.adn.ec.azureedge.net" Heuristic match: "*.fms.ec.azureedge.net" Heuristic match: "cdnads.msads.net" Heuristic match: "cdn-resources.windowsphone.com" Heuristic match: "#cdn-resources-beta.windowsphone.com" Heuristic match: "ecnads1.msn.com" Heuristic match: "images-cms-pn.windowsphone-int.com" Heuristic match: "#images-cms-tst.windowsphone-int.com" Heuristic match: "montage.msn.com" Heuristic match: "%*.streaming.mediaservices.windows.net" Heuristic match: "*.origin.mediaservices.windows.net" Heuristic match: "download.sysinternals.com" Heuristic match: "amp.azure.net" Heuristic match: "rt.ms-studiosmedia.com" Heuristic match: "gtm.ms-studiosmedia.com" Heuristic match: "*.aisvc.visualstudio.com" Heuristic match: "*.cdn.powerbi.com" Heuristic match: "dist.asp.net" Heuristic match: "embed.powerbi.com" Heuristic match: "msitembed.powerbi.com" Heuristic match: "dxtembed.powerbi.com" Heuristic match: "*.cdn.powerappscdn.net" Heuristic match: "'downloads.subscriptionsint.tfsallin.net" Heuristic match: "download.my.visualstudio.com" Heuristic match: "cdn.vsassets.io" Heuristic match: "cdnppe.vsassets.io" Heuristic match: "datafactory.azure.com" Heuristic match: "*.cortanaanalytics.com" Heuristic match: "do.skype.com" Heuristic match: "prss.centralvalidation.com" Heuristic match: "*.gallerycdn.vsassets.io" Heuristic match: "*.gallerycdnppe.vsassets.io" Heuristic match: "global.asazure.windows.net" Pattern match: "www.videobreakdown.com" Pattern match: "www.breakdown.me" Heuristic match: "*.gallerycdntest.vsassets.io" Heuristic match: "agavecdn.o365weve-dev.com" Heuristic match: "agavecdn.o365weve-ppe.com" Heuristic match: "agavecdn.o365weve.com" Heuristic match: "download.visualstudio.com" Heuristic match: "*.Applicationinsights.net" Heuristic match: "*.Applicationinsights.io" Heuristic match: "*.sfbassets.com" Heuristic match: "*.sfbassets.net" Heuristic match: "download.mono-project.com" Heuristic match: "&*.streaming.media-test.windows-int.net" Heuristic match: "&*.origin.mediaservices.windows-int.net" Heuristic match: "cdn.wallet.microsoft-ppe.com" Heuristic match: "crosoft.com" Heuristic match: "*.nuget.org" Heuristic match: "*.nugettest.org" Heuristic match: "cdn.botframework.com" Heuristic match: "*.streaming.media.azure.net" Heuristic match: "*.streaming.media.azure-test.net" Heuristic match: "cdn.cloudappsecurity.com" Heuristic match: "*.yammer.com" Heuristic match: "*.videoindexer.ai" Pattern match: "mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%202.crl" Pattern match: "crl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%202.crl0" Pattern match: "www.microsoft.com/pki/mscorp/Microsoft%20IT%20TLS%20CA%202.crt0" Heuristic match: "secure.aadcdn.microsoftonline-p.com"26:T8a1,"iexplore.exe" wrote bytes "b062f1fafe070000" to virtual address "0xFEA355B8" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "401cedfafe070000" to virtual address "0xFF8C2390" (part of module "GDI32.DLL") "iexplore.exe" wrote bytes "401cedfafe070000" to virtual address "0xFF0B12C8" (part of module "USP10.DLL") "iexplore.exe" wrote bytes "401cedfafe070000" to virtual address "0xFDBC05A8" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "00efedfafe070000" to virtual address "0xFE031F30" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "401cedfafe070000" to virtual address "0xFEA35348" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "401cedfafe070000" to virtual address "0x3FF271C0" "iexplore.exe" wrote bytes "5007effafe070000" to virtual address "0xF3852E58" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "401cedfafe070000" to virtual address "0xFEBB6FA0" (part of module "ADVAPI32.DLL") "iexplore.exe" wrote bytes "401cedfafe070000" to virtual address "0x777629A8" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "401cedfafe070000" to virtual address "0xFEEC3330" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "401cedfafe070000" to virtual address "0xFEB2D430" (part of module "IMM32.DLL") "iexplore.exe" wrote bytes "4068f1fafe070000" to virtual address "0xFE031AF0" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "4068f1fafe070000" to virtual address "0xFEA35748" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "4068f1fafe070000" to virtual address "0xFF2FBEA8" (part of module "OLE32.DLL") "iexplore.exe" wrote bytes "00efedfafe070000" to virtual address "0xFBF918D0" (part of module "COMCTL32.DLL") "iexplore.exe" wrote bytes "00efedfafe070000" to virtual address "0xFF2FBC38" (part of module "OLE32.DLL") "iexplore.exe" wrote bytes "90d103f3fe070000f01df23f01000000101ef23f01000000e036f23f01000000501ef23f010000000000000000000000" to virtual address "0x3FF28000" "iexplore.exe" wrote bytes "401cedfafe070000" to virtual address "0xF3851D78" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "b062f1fafe070000" to virtual address "0xF3852DD0" (part of module "IEFRAME.DLL")27:Tc07,"C:\Users\HAPUBWS\AppData\Local\Microsoft\Edge\User Data\Crashpad" (Indicator: "microsoft\edge\user data") in Source: 00000000-00007688-00000BE4-1074007615 "C:\Users\HAPUBWS\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports" (Indicator: "microsoft\edge\user data") in Source: 00000000-00007688-00000BE4-1076418386 "C:\Users\HAPUBWS\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments" (Indicator: "microsoft\edge\user data") in Source: 00000000-00007688-00000BE4-1079770584 "C:\Users\HAPUBWS\AppData\Local\Microsoft\Edge\User Data\OptimizationGuidePredictionModels" (Indicator: "microsoft\edge\user data") in Source: 00000000-00007688-00000BE4-11951062657 "C:\Users\HAPUBWS\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokens" (Indicator: "microsoft\edge\user data") in Source: 00000000-00007688-00000BE4-12624775380 "C:\Users\HAPUBWS\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\d0313995-11ad-4fbc-ac47-fb134ed2e3e0" (Indicator: "microsoft\edge\user data") in Source: 00000000-00007688-00000BE6-28365259099 "C:\Users\HAPUBWS\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\8cef1df6-d724-4c7d-9755-53a15154b536" (Indicator: "microsoft\edge\user data") in Source: 00000000-00007688-00000BE4-28369686505 "C:\Users\HAPUBWS\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\35\10.34.0.32" (Indicator: "microsoft\edge\user data") in Source: 00000000-00007688-00000BE4-203887854618 "C:\Users\HAPUBWS\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\35\scoped_dir7688_2124832466" (Indicator: "microsoft\edge\user data") in Source: 00000000-00007688-00000BE4-205738444365 "C:\Users\HAPUBWS\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.32\LICENSE" (Indicator: "microsoft\edge\user data") in Source: 00000000-00007688-00000BE2-206357050335 "C:\Users\HAPUBWS\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\35\scoped_dir7688_2124832466\LICENSE" (Indicator: "microsoft\edge\user data") in Source: 00000000-00007688-00000BE2-206357050335 "C:\Users\HAPUBWS\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarks" (Indicator: "microsoft\edge\user data") in Source: 00000000-00007688-00000BE2-427007830127 "C:\Users\HAPUBWS\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarks.msbak" (Indicator: "microsoft\edge\user data") in Source: 00000000-00007688-00000BE2-427007830127 "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=103.0.5060.53 "--annotation=exe=%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=103.0.1264.37 --initial-client-data=0xe4,0xe8,0xec,0xe0,0x150,0x7ffdc6f290b8,0x7ffdc6f290c8,0x7ffdc6f290d8" (Indicator: "microsoft\edge\user data") in Source: msedge.exe28:T529,Dropped file: "shopping.js" - Location: [%TEMP%\7688_1296368963\shopping.js]- [targetUID: 00000000-00007688] Dropped file: "edge_driver.js" - Location: [%TEMP%\7688_1296368963\edge_driver.js]- [targetUID: 00000000-00007688] Dropped file: "edge_checkout_page_validator.js" - Location: [%TEMP%\7688_1296368963\edge_checkout_page_validator.js]- [targetUID: 00000000-00007688] Dropped file: "edge_confirmation_page_validator.js" - Location: [%TEMP%\7688_1296368963\edge_confirmation_page_validator.js]- [targetUID: 00000000-00007688] Dropped file: "shopping_iframe_driver.js" - Location: [%TEMP%\7688_1296368963\shopping_iframe_driver.js]- [targetUID: 00000000-00007688] Dropped file: "auto_open_controller.js" - Location: [%TEMP%\7688_1296368963\auto_open_controller.js]- [targetUID: 00000000-00007688] Dropped file: "edge_tracking_page_validator.js" - Location: [%TEMP%\7688_1296368963\edge_tracking_page_validator.js]- [targetUID: 00000000-00007688] Dropped file: "shoppingfre.js" - Location: [%TEMP%\7688_1296368963\shoppingfre.js]- [targetUID: 00000000-00007688] Dropped file: "adblock_snippet.js" - Location: [%TEMP%\7688_653247603\adblock_snippet.js]- [targetUID: 00000000-00007688] Dropped file: "product_page.js" - Location: [%TEMP%\7688_1296368963\product_page.js]- [targetUID: 00000000-00007688]29:T543,"identity_helper.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002740) "identity_helper.exe" called "RtlGetVersion" (UID: 00000000-00002740) "identity_helper.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000003b4d2283fd7f0000503c2c7b21020000000000000000000058b66470fd7f00001033a885fd7f0000000000000000000000002170fd7f000070c40fcfbf0000001041e782fd7f0000000000000000000030c40fcfbf000000000000000000000000000000000000000100000000000000b840e782fd7f0000f003000000000000010000000000000000002170fd7f00003b4d2283fd7f00000000000000000000e8c80fcfbf0000000000000000000000a0443270fd7f0000d09a6470fd7f0000e8f8e682fd7f0000d09a6470fd7f0000a0443270fd7f00000d000000000000000d000000fd7f000048cd5670fd7f0000059e2b70fd7f0000a0443270 (UID: 00000000-00002740)2a:T66a,"identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002740) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002740) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002740) "identity_helper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002740) "identity_helper.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002740) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002740) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002740) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002740) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00002740) "identity_helper.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Edge\Application\119.0.2151.58\msedge.dll (UID: 00000000-00002740) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002740) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002740) "identity_helper.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002740) "identity_helper.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002740)2b:T1bd9,"identity_helper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter RtlCaptureStackBackTrace (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter RtlGetDeviceFamilyInfoEnum (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter PrefetchVirtualMemory (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002740) "identity_helper.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002740)2c:Td4c,Found string ""baysidebuddy.com"," (Indicator: "ebuddy.com"; File: "wallet-pre-stable.json") Found string ""comeherebuddy.com"," (Indicator: "ebuddy.com"; File: "wallet-pre-stable.json") Found string ""www.facebook.com"," (Indicator: "facebook.com"; File: "wallet-pre-stable.json") Found string ""linkedin.com"," (Indicator: "linkedin.com"; File: "wallet-pre-stable.json") file/memory contains long string with (Indicator: "twitter"; File: "edge_driver.js") Found string ""accounts.craigslist.org": "{\"Tier1\": [6061 214] \"Tier2\": [629 5401 9598 1780]}"," (Indicator: "craigslist.org"; File: "uu_host_config") Found string ""accounts.youtube.com": "{\"Tier1\": [983 1103 8845] \"Tier2\": [2413 9121]}"," (Indicator: "youtube"; File: "uu_host_config") Found string ""akroncanton.craigslist.org": "{\"Tier1\": [8405 214 7818] \"Tier2\": [3023 3604 8183 5737]}"," (Indicator: "craigslist.org"; File: "uu_host_config") Found string ""albany.craigslist.org": "{\"Tier1\": [8405 214] \"Tier2\": [9396 3604 2078]}"," (Indicator: "craigslist.org"; File: "uu_host_config") Found string ""albuquerque.craigslist.org": "{\"Tier1\": [7818 214] \"Tier2\": [508 2161 8783]}"," (Indicator: "craigslist.org"; File: "uu_host_config") Found string ""allentown.craigslist.org": "{\"Tier1\": [214 8405 7818] \"Tier2\": [2161]}"," (Indicator: "craigslist.org"; File: "uu_host_config") Found string ""anchorage.craigslist.org": "{\"Tier1\": [8405 214 7818] \"Tier2\": [1762 2161]}"," (Indicator: "craigslist.org"; File: "uu_host_config") Found string ""api.twitter.com": "{\"Tier1\": [1103 6061] \"Tier2\": [7290 1780 9381 1983]}"," (Indicator: "twitter"; File: "uu_host_config") Found string ""appleton.craigslist.org": "{\"Tier1\": [214 8405 7818] \"Tier2\": [3604 2161]}"," (Indicator: "craigslist.org"; File: "uu_host_config") Found string ""apps.facebook.com": "{\"Tier1\": [1103 6061] \"Tier2\": [5445 1780 5106 6420]}"," (Indicator: "facebook.com"; File: "uu_host_config") Found string ""asheville.craigslist.org": "{\"Tier1\": [8405 214 7818] \"Tier2\": [3604 2161]}"," (Indicator: "craigslist.org"; File: "uu_host_config") Found string ""atlanta.craigslist.org": "{\"Tier1\": [214 8405] \"Tier2\": [9876 1303 6463]}"," (Indicator: "craigslist.org"; File: "uu_host_config") Found string ""austin.craigslist.org": "{\"Tier1\": [8405 7234 214 7818] \"Tier2\": [184 86 2161]}"," (Indicator: "craigslist.org"; File: "uu_host_config") Found string ""badoo.com": "{\"Tier1\": [6061 9785 1103 8223] \"Tier2\": [1656 1141 8536 4973]}"," (Indicator: "badoo.com"; File: "uu_host_config") Found string ""bakersfield.craigslist.org": "{\"Tier1\": [8405 214] \"Tier2\": []}"," (Indicator: "craigslist.org"; File: "uu_host_config") Found string ""baltimore.craigslist.org": "{\"Tier1\": [8405 214] \"Tier2\": [9237 3604 3023 2161]}"," (Indicator: "craigslist.org"; File: "uu_host_config") Found string ""batonrouge.craigslist.org": "{\"Tier1\": [8405 214] \"Tier2\": [9396]}"," (Indicator: "craigslist.org"; File: "uu_host_config") Found string ""bellingham.craigslist.org": "{\"Tier1\": [8405 214] \"Tier2\": [166 9396]}"," (Indicator: "craigslist.org"; File: "uu_host_config") Found string ""bend.craigslist.org": "{\"Tier1\": [8405 214 7818] \"Tier2\": [3604 2161]}"," (Indicator: "craigslist.org"; File: "uu_host_config")2d:T511,"identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\bcrypt.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\119.0.2151.58\bcrypt.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\StateRepository.Core.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\Windows.StateRepository.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\msvcp110_win.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\IPHLPAPI.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\XmlLite.dll" "identity_helper.exe" trying to access non-existent file "C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\CFGMGR32.dll" "identity_helper.exe" trying to access non-existent file "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\CFGMGR32.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\CFGMGR32.dll"2e:T746,Observed email domain:""colourpop.com"," [Source: wallet-pre-stable.json] Observed email domain:""aepop.net"," [Source: wallet-pre-stable.json] Observed email domain:""artpop.com"," [Source: wallet-pre-stable.json] Observed email domain:""avenuepop.com"," [Source: wallet-pre-stable.json] Observed email domain:""bassettbmx.com"," [Source: wallet-pre-stable.json] Observed email domain:""canvasmx.com"," [Source: wallet-pre-stable.json] Observed email domain:""drinkolipop.com"," [Source: wallet-pre-stable.json] Observed email domain:""fashionfunpop.com"," [Source: wallet-pre-stable.json] Observed email domain:""fastandloosebmx.com"," [Source: wallet-pre-stable.json] Observed email domain:""flitebmx.com"," [Source: wallet-pre-stable.json] Observed email domain:""fofopop.com"," [Source: wallet-pre-stable.json] Observed email domain:""gellipop.com"," [Source: wallet-pre-stable.json] Observed email domain:""gforcemx.com"," [Source: wallet-pre-stable.json] Observed email domain:""happipop.com"," [Source: wallet-pre-stable.json] Observed email domain:""hauzofpop.com"," [Source: wallet-pre-stable.json] Observed email domain:""hiccapop.com"," [Source: wallet-pre-stable.json] Observed email domain:""hijabipop.com"," [Source: wallet-pre-stable.json] Observed email domain:""jellypop.la"," [Source: wallet-pre-stable.json] Observed email domain:""kinkbmx.com"," [Source: wallet-pre-stable.json] Observed email domain:""kloudkpop.com"," [Source: wallet-pre-stable.json] Observed email domain:""knitpop.com"," [Source: wallet-pre-stable.json] Observed email domain:""kpop.exchange"," [Source: wallet-pre-stable.json] Observed email domain:""laperlamx.com"," [Source: wallet-pre-stable.json] Observed email domain:""lovepop.com"," [Source: wallet-pre-stable.json] Observed email domain:""lullipop.com"," [Source: wallet-pre-stable.json]2f:T7bf,""4amscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""6whiskey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""99centsubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""allieandmickey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""alteregoscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""annabelbleu.com"," (Source: wallet-pre-stable.json, Indicator: "leu.com") ""aspirefashionscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""augustbleu.com"," (Source: wallet-pre-stable.json, Indicator: "leu.com") ""bananasmonkey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""baseballmonkey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""beautiiskey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""beautyandwhiskey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""bellagracehealthscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""belleandbubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""beyondblessedscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""blingbykey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""boosted-luckey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""bowlingmonkey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""burgeonbleu.com"," (Source: wallet-pre-stable.json, Indicator: "leu.com") ""busybeescrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""cabbagekey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com") ""coatsandscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""codenxtscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""cognitiontsscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com") ""concreterosescrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com")30:T4001,"{"aee_config":{"ar":{"price_regex":{"ae":"(((ae|aed|\\x{062F}\\x{0660}\\x{0625}\\x{0660}|\\x{062F}\\.\\x{0625}|dhs|dh)\\s*\\d{1 3})|(\\d{1,3}\\s*(ae|aed|\\x{062F}\\x{0660}\\x{0625}\\x{0660}|\\x{062F}\\.\\x{0625}|dhs|dh)))","dz":"(((dzd|da|\\x{062F}\\x{062C})\\s*\\d{1 3})|(\\d{1,3}\\s*(dzd|da|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}|egp)\\s*\\d{1 3})|(\\d{1,3}\\s*(e\\x{00a3}|egp)))","ma":"(((mad|dhs|dh)\\s*\\d{1 3})|(\\d{1,3}\\s*(mad|dhs|dh)))","sa":"((\\d{1,3}\\s*(sar\\s*\\x{fdfc}|sar|sr|\\x{fdfc}|\\.\\x{0631}\\.\\x{0633}))|((sar\\s*\\x{fdfc}|sar|sr|\\x{fdfc}|\\.\\x{0631}\\.\\x{0633})\\s*\\d{1 3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s*\\x{0625}\\x{0644}\\x{0649}\\s*\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})|(\\x{0623}\\x{0636}\\x{0641}\\s*\\x{0625}\\x{0644}\\x{0649}\\s*\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}\\x{0627}\\x{062A}\\s*\\x{0627}\\x{0644}\\x{062A}\\x{0648}\\x{0635}\\x{064A}\\x{0644})|(\\x{0627}\\x{0644}\\x{062A}\\x{0648}\\x{0635}\\x{064A}\\x{0644}\\s*\\x{0641}\\x{064A}\\s*\\x{0646}\\x{0641}\\x{0633}\\s*\\x{0627}\\x{0644}\\x{064A}\\x{0648}\\x{0645}\\s*\\x{0645}\\x{062A}\\x{0627}\\x{062D}))"},"autofill_onnx_model_config":{"autofill_class_map":{"0":"ACCOUNT_CREATION_PASSWORD","1":"ADDRESS_HOME_CITY","10":"CONFIRMATION_PASSWORD","11":"CREDIT_CARD_EXP_2_DIGIT_YEAR","12":"CREDIT_CARD_EXP_4_DIGIT_YEAR","13":"CREDIT_CARD_EXP_DATE_2_DIGIT_YEAR","14":"CREDIT_CARD_EXP_DATE_4_DIGIT_YEAR","15":"CREDIT_CARD_EXP_MONTH","16":"CREDIT_CARD_NAME_FIRST","17":"CREDIT_CARD_NAME_FULL","18":"CREDIT_CARD_NAME_LAST","19":"CREDIT_CARD_NUMBER","2":"ADDRESS_HOME_COUNTRY","20":"CREDIT_CARD_TYPE","21":"CREDIT_CARD_VERIFICATION_CODE","22":"DATE_OF_BIRTH_DAY","23":"DATE_OF_BIRTH_DD_MM_YYYY_DELIM_SLASH","24":"DATE_OF_BIRTH_DD_MM_YY_DELIM_SLASH","25":"DATE_OF_BIRTH_MM_DD_YYYY_DELIM_SLASH","26":"DATE_OF_BIRTH_MM_DD_YY_DELIM_SLASH","27":"DATE_OF_BIRTH_MONTH","28":"DATE_OF_BIRTH_YEAR","29":"EMAIL_ADDRESS","3":"ADDRESS_HOME_LINE1","30":"MERCHANT_PROMO_CODE","31":"NAME_FIRST","32":"NAME_FULL","33":"NAME_LAST","34":"NAME_MIDDLE","35":"NEW_PASSWORD","36":"PASSWORD","37":"PHONE_FAX_NUMBER","38":"PHONE_HOME_CITY_AND_NUMBER","39":"PHONE_HOME_CITY_CODE","4":"ADDRESS_HOME_LINE2","40":"PHONE_HOME_COUNTRY_CODE","41":"PHONE_HOME_EXTENSION","42":"PHONE_HOME_NUMBER","43":"PHONE_HOME_WHOLE_NUMBER","44":"PRICE","45":"PROBABLY_NEW_PASSWORD","46":"SEARCH_TERM","47":"UNKNOWN_TYPE","48":"USERNAME","5":"ADDRESS_HOME_LINE3","6":"ADDRESS_HOME_STATE","7":"ADDRESS_HOME_STREET_ADDRESS","8":"ADDRESS_HOME_ZIP","9":"COMPANY_NAME"},"autofill_class_num":49,"autofill_field_confidence_bar":{"ACCOUNT_CREATION_PASSWORD":"0.6","ADDRESS_HOME_CITY":"0.9","ADDRESS_HOME_COUNTRY":"0.9","ADDRESS_HOME_LINE1":"0.75","ADDRESS_HOME_LINE2":"0.6","ADDRESS_HOME_LINE3":"0.6","ADDRESS_HOME_STATE":"0.6","ADDRESS_HOME_STREET_ADDRESS":"0.6","ADDRESS_HOME_ZIP":"0.6","COMPANY_NAME":"0.9999","CONFIRMATION_PASSWORD":"0.65","CREDIT_CARD_EXP_2_DIGIT_YEAR":"0.75","CREDIT_CARD_EXP_4_DIGIT_YEAR":"0.75","CREDIT_CARD_EXP_DATE_2_DIGIT_YEAR":"0.75","CREDIT_CARD_EXP_DATE_4_DIGIT_YEAR":"0.75","CREDIT_CARD_EXP_MONTH":"0.75","CREDIT_CARD_NAME_FIRST":"0.75","CREDIT_CARD_NAME_FULL":"0.75","CREDIT_CARD_NAME_LAST":"0.75","CREDIT_CARD_NUMBER":"0.75","CREDIT_CARD_TYPE":"0.75","CREDIT_CARD_VERIFICATION_CODE":"0.75","DATE_OF_BIRTH_DAY":"0.9","DATE_OF_BIRTH_DD_MM_YYYY_DELIM_SLASH":"0.9999","DATE_OF_BIRTH_DD_MM_YY_DELIM_SLASH":"0.9999","DATE_OF_BIRTH_MM_DD_YYYY_DELIM_SLASH":"0.9999","DATE_OF_BIRTH_MM_DD_YY_DELIM_SLASH":"0.9999","DATE_OF_BIRTH_MONTH":"0.9","DATE_OF_BIRTH_YEAR":"0.9","EMAIL_ADDRESS":"0.6","MERCHANT_PROMO_CODE":"0.6","NAME_FIRST":"0.6","NAME_FULL":"0.9","NAME_LAST":"0.6","NAME_MIDDLE":"0.6","NEW_PASSWORD":"0.65","PASSWORD":"0.6","PHONE_FAX_NUMBER":"0.9","PHONE_HOME_CITY_AND_NUMBER":"0.9","PHONE_HOME_CITY_CODE":"0.9","PHONE_HOME_COUNTRY_CODE":"0.9","PHONE_HOME_EXTENSION":"0.9","PHONE_HOME_NUMBER":"0.9","PHONE_HOME_WHOLE_NUMBER":"0.9","PRICE":"0.6","PROBABLY_NEW_PASSWORD":"0.6","SEARCH_TERM":"0.6","UNKNOWN_TYPE":"0.6","USERNAME":"0.65"},"autofill_language_confidence_bar":{"default":0.8,"en":0.85},"autofill_max_sequence_length":384,"autofill_sliding_window":256},"bg":{"price_regex":{"bg":"((\\d{1,3}\\s*(bgn|\\x{043B}\\x{0432}|\\x{043B}\\x{0432}\\.))|((bgn|\\x{043B}\\x{0432}|\\x{043B}\\x{0432}\\.)\\s*\\d{1 3}))"},"product_terms":"((\\x{0414}\\x{043E}\\x{0431}\\x{0430}\\x{0432}\\x{0438}\\s*\\x{0432}\\s*\\x{043A}\\x{043E}\\x{0448}\\x{043D}\\x{0438}\\x{0446}\\x{0430}\\x{0442}\\x{0430})|(\\x{0414}\\x{043E}\\x{0431}\\x{0430}\\x{0432}\\x{0438}\\s*\\x{0432}\\s*\\x{043A}\\x{043E}\\x{043B}\\x{0438}\\x{0447}\\x{043A}\\x{0430}\\x{0442}\\x{0430})|(\\x{0414}\\x{0440}\\x{0443}\\x{0433}\\x{0438}\\s*\\x{043E}\\x{0444}\\x{0435}\\x{0440}\\x{0442}\\x{0438})|(\\x{041F}\\x{043E}\\x{0434}\\x{043E}\\x{0431}\\x{043D}\\x{0438}\\s*\\x{043F}\\x{0440}\\x{043E}\\x{0434}\\x{0443}\\x{043A}\\x{0442}\\x{0438})|(\\x{0412}\\s*\\x{043D}\\x{0430}\\x{043B}\\x{0438}\\x{0447}\\x{043D}\\x{043E}\\x{0441}\\x{0442})|(\\x{041E}\\x{043F}\\x{0438}\\x{0441}\\x{0430}\\x{043D}\\x{0438}\\x{0435}\\s*\\x{043D}\\x{0430}\\s*\\x{043F}\\x{0440}\\x{043E}\\x{0434}\\x{0443}\\x{043A}\\x{0442}\\x{0430}))"},"bs":{"price_regex":{"ba":"((\\d{1,3}\\s*(bam|km|,-\\s*km))|((bam|km|,-\\s*km)\\s*\\d{1 3}))"},"product_terms":"((dodajte\\s*u\\s*korpu)|(dodaj\\s*u\\s*korpu)|(u\\s*ko\\x{0161}aricu)|(sli\\x{010D}nim\\s*proizvodima)|(opcije\\s*dostave)|(u\\s*prodavnici))"},"character_cutoff":400,"citations":{"domains":{"academic":["nih.gov","sciencedirect.com","lww.com","acs.org","sagepub.com","arxiv.org","tandfonline.com","semanticscholar.org","jstor.org","ieee.org","rsc.org","sciencemag.org","frontiersin.org","iop.org","pnas.org","europepmc.org","scitation.org","scirp.org","acm.org","ashpublications.org","ascopubs.org","oclc.org","osapublishing.org","osti.gov","repec.org","annualreviews.org","spiedigitallibrary.org","iaea.org","ascelibrary.org","philpapers.org","cabdirect.org","bioone.org","aom.org","onepetro.org","scilit.net","ajol.info","iiste.org","doaj.org","paperity.org","escholarship.org","emeraldgrouppublishing.com","irena.org","indianjournals.com","safetylit.org","link.springer.com","onlinelibrary.wiley.com","rd.springer.com","econpapers.repec.org","academic.oup.com","iopscience.iop.org","papers.ssrn.com","hdl.handle.net","aip.scitation.org","link.aps.org","pubs.rsc.org","doi.ieeecomputersociety.org","muse.jhu.edu","insights.ovid.com","insights.ovid.com","proceedings.spiedigitallibrary.org","espace.library.uq.edu.au","discovery.ucl.ac.uk","lirias.kuleuven.be","doi.acm.org","jhu.pure.elsevier.com","psycnet.apa.org","biblio.ugent.be","lup.lub.lu.se","journals.plos.org","research.monash.edu","experts.umn.edu","asmedigitalcollection.asme.org","moh-it.pure.elsevier.com","agupubs.onlinelibrary.wiley.com","scholars.northwestern.edu","proceedings.asmedigitalcollection.asme.org","export.arxiv.org","journals.lww.com","mdanderson.elsevierpure.com","digital-library.theiet.org","digital.csic.es","experts.illinois.edu","research.vu.nl","kclpure.kcl.ac.uk","research-repository.uwa.edu.au","synapse.koreamed.org","eprints.qut.edu.au","vbn.aau.dk","repository.tudelft.nl","iovs.arvojournals.org","mayoclinic.pure.elsevier.com","eprints.gla.ac.uk","download.atlantis-press.com","repub.eur.nl","researchers.mq.edu.au","chemistry-europe.onlinelibrary.wiley.com","content.sciendo.com","zora.uzh.ch","researchportal.helsinki.fi","content.iospress.com","file.scirp.org","helda.helsinki.fi","findresearcher.sdu.dk","eprints.whiterose.ac.uk","repository.cam.ac.uk","biomedcentral.com","bmj.com","mdpi.com","jamanetwork.com","plos.org","thelancet.com","ssrn.com","emerald.com","springeropen.com","liebertpub.com","degruyter.com","scientific.net","brill.com","allenpress.com","publons.com","spandidos-publications.com","eurekaselect.com","ingentaconnect.com","thieme-connect.com","ores.su","inderscienceonline.com","jcreview.com","research.ed.ac.uk","cancerres.aacrjournals.org","dro.deakin.edu.au","publications.hse.ru","research-collection.ethz.ch","biomedcentral.com"],"books":["studocu.com","libguides.com","nap.edu","intechopen.com","oreilly.com","books.openedition.org","taylorfrancis.com"],"newspapers":["cnn.com","nytimes.com","usatoday.com","nypost.com","washingtonpost.com","usnews.com","cbsnews.com","nbcnews.com","cnbc.com","bbc.com","latimes.com","newsweek.com","snopes.com","thehill.com","chron.com","time.com","apnews.com","indiatimes.com","bizjournals.com","cbc.ca","mercurynews.com","ndtv.com","abc7news.com","indianexpress.com","hindustantimes.com","uci.edu","fortune.com","straitstimes.com","businessinsider.in","businessinsider.in","channelnewsasia.com","financialexpress.com","financialexpress.com","livemint.com","mustsharenews.com","theindependent.sg"],"websites":["searchenginejournal.com","unenvironment.org","wikipedia.org","msn.com","reddit.com","fandom.com","pinterest.com","webmd.com","stackoverflow.com","healthline.com","weather.com","drugs.com","ny.gov","quora.com","cnet.com","cdc.gov","britannica.com","merriam-webster.com","forbes.com","wikihow.com","wa.gov","coursehero.com","fivethirtyeight.com","github.com","noaa.gov","timeanddate.com","thefreedictionary.com","dictionary.com","investopedia.com","goodreads.com","stackexchange.com","huffpost.com","medicalnewstoday.com","weather.gov","history.com","thoughtco.com","businessinsider.com","howtogeek.com","wunderground.com","npr.org","khanacademy.org","sfgate.com","usda.gov","theguardian.com","bloomberg.com","ed.gov","politico.com","psychologytoday.com","medium.com","kaiserpermanente.org","worldometers.info","urbandictionary.com","brainly.in","oregon.gov","pbs.org","archive.org","nps.gov","clevelandclinic.org","thespruce.com","marketwatch.com","purdue.edu","enotes.com","fool.com","hunker.com","w3schools.com","wiley.com","fda.gov","yourdictionary.com","sparknotes.com","nextdoor.com","docusign.com","wsj.com","reuters.com","nasa.gov","tutorialspoint.com","thebalance.com","biography.com","consumerreports.org","elsevier.com","livestrong.com","lumenlearning.com","nasdaq.com","geeksforgeeks.org","medicinenet.com","epa.gov","nationalgeographic.com","usgs.gov","worldatlas.com","prezi.com","socratic.org","springer.com","mathworks.com","slack.com","slate.com","statista.com","census.gov","slideshare.net","rei.com","nerdwallet.com","pge.com","osha.gov","doordash.com","howstuffworks.com","livescience.com","oregonlive.com","theatlantic.com","shutterstock.com","collinsdictionary.com","joebiden.com","familyhandyman.com","thebalancesmb.com","who.int","theverge.com","sciencing.com","vox.com","wiktionary.org","variety.com","scribd.com","insider.com","bobvila.com","archives.gov","boredpanda.com","nwcg.gov","alltrails.com","computerhope.com","medscape.com","bls.gov","libretexts.org","medlineplus.gov","nymag.com","angieslist.com","seekingalpha.com","europa.eu","loc.gov","sec.gov","inc.com","unsplash.com","apa.org","wikimedia.org","wired.com","popularmechanics.com","worldpopulationreview.com","askubuntu.com","everydayhealth.com","smithsonianmag.com","aljazeera.com","nist.gov","mentalfloss.com","turnitin.com","worldcat.org","coursera.org","sciencedaily.com","gizmodo.com","nationalgeographic.org","superuser.com","issuu.com","techtarget.com","guru99.com","encyclopedia.com","codeproject.com","colorado.edu","ti.com","macrotrends.net","serverfault.com","phys.org","theculturetrip.com","ancient.eu","space.com","pewresearch.org","theconversation.com","atlassian.com","scribbr.com","uchicago.edu","c-sharpcorner.com","weforum.org","energy.gov","deloitte.com","entrepreneur.com","nature.com","jetbrains.com","towardsdatascience.com","engineeringtoolbox.com","cloudfront.net","fastcompany.com","scientificamerican.com","imgur.com","economist.com","prnewswire.com","pypi.org","tutsplus.com","hbr.org","actblue.com","ft.com","gatech.edu","udemy.com","worldbank.org","airnow.gov","toppr.com","android.com","fiverr.com","cmu.edu","vice.com","brookings.edu","axios.com","travelandleisure.com","mysql.com","barrons.com","tradingeconomics.com","uc.edu","ukessays.com","eia.gov","git-scm.com","lonelyplanet.com","javatpoint.com","freepik.com","ahajournals.org","businesswire.com","crunchbase.com","trane.com","atlasobscura.com","techcrunch.com","npmjs.com","cyberciti.biz","programiz.com","simplypsychology.org","hindawi.com","techopedia.com","digitalocean.com","cell.com","uakron.edu","calendly.com","asp.net","freecodecamp.org","physicsclassroom.com","globenewswire.com","baeldung.com","dzone.com","thomasnet.com","fao.org","w3resource.com","overleaf.com","iqair.com","flaticon.com","caltech.edu","universityofcalifornia.edu","purpleair.com","ourworldindata.org","fueleconomy.gov","mckinsey.com","treehugger.com","uchealth.com","allaboutcircuits.com","dev.to","nrc.gov","tecmint.com","amazonaws.com","getbootstrap.com","electrek.co","questia.com","spacex.com","gitlab.com","php.net","sciencealert.com","qz.com","linuxize.com","universetoday.com","envato.com","codepen.io","realpython.com","oecd.org","asme.org","webofknowledge.com","docusign.net","energysage.com","ebsco.com","sci-hub.se","softwaretestinghelp.com","earthsky.org","mendeley.com","edureka.co","sitepoint.com","css-tricks.com","owler.com","techonthenet.com","tensorflow.org","phoenixnap.com","newyorker.com","lennox.com","mongodb.com","insideevs.com","ethz.ch","cloudflare.com","worldwildlife.org","newscientist.com","jquery.com","doe.gov","oberlo.com","improvenet.com","energystar.gov","w3.org","greenbuildingadvisor.com","kaggle.com","codecademy.com","directenergy.com","g2.com","discovermagazine.com","fixr.com","wpbeginner.com","datacamp.com","influencermarketinghub.com","ebscohost.com","solarreviews.com","academic-accelerator.com","reactjs.org","ibisworld.com","proquest.com","fontawesome.com","timeshighereducation.com","cleantechnica.com","streetdirectory.com","journaldev.com","futurism.com","nwf.org","anl.gov","aqicn.org","constellation.com","wordstream.com","stackabuse.com","buffer.com","lbl.gov","machinelearningmastery.com","interestingengineering.com","pluralsight.com","monash.edu","analyticsvidhya.com","mysqltutorial.org","nrdc.org","igi-global.com","esa.int","electronics-tutorials.ws","scimagojr.com","yourstory.com","panopto.com","ornl.gov","modernize.com","gale.com","themeforest.net","nrel.gov","greencarreports.com","colorlib.com","teamtreehouse.com","cas.org","sgpbusiness.com","tutorialsteacher.com","scielo.br","intellipaat.com","templatemonster.com","ucsusa.org","beginnersbook.com","ahrefs.com","toptal.com","bitdegree.org","mongabay.com","pnnl.gov","orcid.org","explainthatstuff.com","sproutsocial.com","iea.org","clarivate.com","worldscientific.com","dribbble.com","compactappliance.com","asm-air.com","rug.nl","dovepress.com","editage.com","asiaone.com","mdbootstrap.com","laravel.com","archives-ouvertes.fr","a-z-animals.com","scopus.com","cloudways.com","libgen.rs","tutorialrepublic.com","energyvanguard.com","sanfoundry.com","ocbc.com","smashingmagazine.com","civilica.com","sci-hub.st","energyeducation.ca","greentechmedia.com","jsfiddle.net","cqvip.com","buildinggreen.com","solarpowerworldonline.com","wri.org","semrush.com","energycentral.com","theworldcounts.com","iucn.org","xspdf.com","gtmetrix.com","springernature.com","infona.pl","panda.org","edf.org","batteryuniversity.com","seaworld.org","singtel.com","world-nuclear.org","codecanyon.net","businessofapps.com","emarketer.com","heinonline.org","thesmartlocal.com","doi.org","letpub.com","greencarcongress.com","sgx.com","waset.org","power-technology.com","moz.com","laracasts.com","goodyfeed.com","iucnredlist.org","codegrepper.com","renewableenergyworld.com","resurchify.com","editorialmanager.com","pv-magazine.com","mewatch.sg","mothership.sg","dblp.org","defenders.org","taylorandfrancis.com","theseus.fi","inspirehep.net","todayonline.com","atlantis-press.com","cairn.info","narcis.nl","seia.org","openei.org","talis.com","saveonenergy.com","arxiv-vanity.com","computer.org","openathens.net","starhub.com","bbcollab.com","exlibrisgroup.com","solarpowerrocks.com","energyusecalculator.com","web.dev","crossref.org","earthled.com","awf.org","manuscriptcentral.com","issn.org","wikidata.org","educative.io","tnp.sg","tnp.sg","wikicn.top","aceee.org","inderscience.com","copyright.com","8days.sg","osf.io","awi"1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"2555ccb012b304e6b60596ba602f18d4d942c4d50fc623d77742cbe6d1f9e80b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":76,"unified_at_epoch_ms":1790305056263,"unified_at":"2026-09-25T02:57:36.263Z","metadata":{"hashes":{"sha256":"2555ccb012b304e6b60596ba602f18d4d942c4d50fc623d77742cbe6d1f9e80b","sha1":"2b476904dd41dbc638d09fb63e63271c3194e6c4","md5":"227de8698f5f413ebf5154a52a15d1c6","sha512":"667715a8fa5d74ea59ba0ba799e0683e092f6da7b45d8bb6752d5c283268e8431be46732d6c9991ad741d35a64bb2cf2e973f45e6b6ca3429d9d66bb24d86c22","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"http://login.microsoftonline.com/","file_type":["url"],"file_type_id":"url","file_size":0,"is_container_sample":false,"url_analysis":true},"submissions":{"first_seen":1527263732000,"last_seen":1724702046000,"last_multi_scan":1724702046000}},"detections":{"summary":{"verdict":"malicious","score":76,"tags":["asn14340","registry","ads2","rightsteven","areyouon","gmbh","technicolor","dlink","tplink","googlschromemediarouter"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":5},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":22},"sandbox_signatures":{"informative_count":42,"suspicious_count":15,"malicious_count":4,"total":61},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"bforeai":{"name":"BforeAI","success":true,"verdict":"clean","status":"clean","progress":100,"data_source":"BforeAI","permalink":"https://bfore.ai/","extra_fields":[{"name":"percent","value":0}]},"cleandns":{"name":"CleanDNS","success":true,"verdict":"undetected","status":"no-result","progress":100,"data_source":"CleanDNS","permalink":"https://www.cleandns.com/","extra_fields":[{"name":"domain","value":"login.microsoftonline.com"},{"name":"percent","value":0},{"name":"reports_count","value":0}]},"criminalip":{"name":"Criminal IP","success":true,"verdict":"clean","status":"clean","progress":100,"data_source":"Criminal IP","permalink":"https://www.criminalip.io/","report_link":"https://www.criminalip.io/domain/report?scan_id=15120047","extra_fields":[{"name":"phishing_probability","value":1.03},{"name":"is_fake_domain","value":false},{"name":"suspicious_file_count","value":0},{"name":"is_invalid_ssl","value":false},{"name":"dga_score","value":0},{"name":"phishing_record_count","value":4},{"name":"credential_input","value":"safe"},{"name":"is_url_analysis","value":true},{"name":"suspicious_html_element_count","value":0},{"name":"is_suspicious_cookie","value":false},{"name":"critical_abuse_record_count","value":0},{"name":"dangerous_abuse_record_count","value":5},{"name":"is_mitm_attack","value":false},{"name":"percent","value":20}]},"scamadviser":{"name":"ScamAdviser","success":true,"verdict":"clean","status":"clean","progress":100,"data_source":"ScamAdviser","permalink":"https://www.scamadviser.com/?utm_source=hybridanalysis","report_link":"https://www.scamadviser.com/check-website/login.microsoftonline.com?utm_source=hybridanalysis","extra_fields":[{"name":"domain","value":"login.microsoftonline.com"},{"name":"percent","value":0}]},"urlscanio":{"name":"urlscan.io","success":true,"verdict":"undetected","status":"no-classification","progress":100,"data_source":"urlscan.io","permalink":"https://urlscan.io/","report_link":"https://urlscan.io/result/cc3f504a-dde1-4c5c-b654-647457e0f369/","extra_fields":[{"name":"percent","value":0}]}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"informative","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"638987da02acf22efc3c277c"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"suspicious","value":"The input sample dropped/contains a certificate file"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Drops a license file"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Additional Submission Context","description":"Submission context: \"http://login.microsoftonline.com/\"\n Submission context: \"http://login.microsoftonline.com\"","origin":"File/Memory","relevance":10,"id":"string-42","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"suk.officehome.msocdn.com\"\n \"spoprod-a.akamaihd.net\"\n \"secure.aadcdn.microsoftonline-p.com\"\n \"login.microsoftonline.com\"\n \"admin.onedrive.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"},{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.40.240.48:443\"\n \"2.20.189.74:80\"\n \"172.227.108.122:443\"\n \"23.37.48.112:443\"\n \"2.16.106.91:443\"\n \"52.114.74.43:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"},{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"},{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\IsoScope_e3c_ConnHashTable<3644>_HashTable_Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"\\Sessions\\1\\BaseNamedObjects\\IsoScope_e3c_IESQMMUTEX_0_303\"\n \"\\Sessions\\1\\BaseNamedObjects\\IsoScope_e3c_IESQMMUTEX_0_331\"\n \"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}\"\n \"Local\\InternetShortcutMutex\"\n \"IsoScope_e3c_IESQMMUTEX_0_331\"\n \"Local\\ZonesCacheCounterMutex\"\n \"IsoScope_e3c_ConnHashTable<3644>_HashTable_Mutex\"\n \"IsoScope_e3c_IESQMMUTEX_0_519\"\n \"UpdatingNewTabPageData\"\n \"Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"IsoScope_e3c_IESQMMUTEX_0_303\"\n \"Local\\URLBLOCK_DOWNLOAD_MUTEX\"\n \"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}\"\n \"IsoScope_e3c_IE_EarlyTabStart_0xe34_Mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"},{"report_type":"sandbox","report_id":"638987da02acf22efc3c277c"},{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"},{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"microsoft_logo[1].svg\" as clean (type is \"HTML document ASCII text with very long lines with no line terminators\")\n Antivirus vendors marked dropped file \"urlblockindex[1].bin\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"ellipsis_grey[1].svg\" as clean (type is \"HTML document ASCII text with very long lines with no line terminators\")\n Antivirus vendors marked dropped file \"ellipsis_white[1].svg\" as clean (type is \"HTML document ASCII text with very long lines with no line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"638987da02acf22efc3c277c"},{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"},{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00010187-00003644)\n Launches browser \"iexplore.exe\" (UID: 00010208-00003852)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"0XE0000000L\"","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00010187-00003644) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"\n Process \"iexplore.exe\" (UID: 00010208-00003852) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"iexplore.exe\" (UID: 00010208-00003852) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"},{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"http://login.microsoftonline.com/\" (UID: 00010187-00003644)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3644 CREDAT:275457 /prefetch:2\" (UID: 00010208-00003852)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"},{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"},{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"http://login.microsoftonline.com/\" (UID: 00010187-00003644)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3644 CREDAT:275457 /prefetch:2\" (UID: 00010208-00003852)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"},{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"iexplore.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\conhost.exe\", Handle: 884)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"},{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$24","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"},{"report_type":"sandbox","report_id":"638987da02acf22efc3c277c"},{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"},{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$25","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"},{"report_type":"sandbox","report_id":"638987da02acf22efc3c277c"},{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"},{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 6509 bytes 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$26","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"},{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"\"download.sysinternals.com\" (Indicator: \"sysinternals\")","origin":"File/Memory","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"pipe.skype.com\" (Indicator: \"skype.com\"; File: \"network.pcap\")\n \"*.pipe.skype.com0\" (Indicator: \"skype.com\"; File: \"network.pcap\")\n \"*.cdn.skype.com\" (Indicator: \"skype.com\"; File: \"network.pcap\")\n \"*.dev.skype.com\" (Indicator: \"skype.com\"; File: \"network.pcap\")\n \"do.skype.com\" (Indicator: \"skype.com\"; File: \"network.pcap\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"iexplore.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5b5604c37ca3e17aa6040456"},{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"iexplore.exe\" is protecting 8192 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"},{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"}]},{"level":"informative","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"pspubws@outlook.office365[2].txt\" containing the Windows username \"PSPUBWS\"\n Found dropped filename \"pspubws@office[1].txt\" containing the Windows username \"PSPUBWS\"\n Found dropped filename \"pspubws@login.microsoftonline[1].txt\" containing the Windows username \"PSPUBWS\"\n Found dropped filename \"pspubws@outlook.office365[1].txt\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"http://login.microsoftonline.com/\" as malicious (1% detection rate)\n 1/67 reputation engines marked \"http://login.microsoftonline.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"}]},{"level":"suspicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"104.40.240.48\": ...\n File SHA256: 16433f5a6b759a51f8a9f75a2258756a2e9fd14539c99303042fb88bebe7d3cf (AV positives: 41/66 scanned on 05/21/2018 06:11:50)\n File SHA256: e3780277c15bd16ab6c1a023b2e00706b2e882a1f1cf899b7fbe554d2c73231b (AV positives: 1/69 scanned on 05/18/2018 14:39:24)\n File SHA256: 4340d283dc66d6270f17b9c9163e3202334be510b525a5525f516f3747e2fd6f (AV positives: 1/69 scanned on 05/17/2018 10:01:52)\n File SHA256: e8ade7f807c7257e1f13354f77a18e0b315cf522ba7e245c6f98ba86a0841f7e (AV positives: 1/68 scanned on 05/14/2018 23:59:30)\n File SHA256: c61d711cf40a1d0a7fc18e68b617572ad6ef5503685618ff0d9561ed6693abf7 (AV positives: 1/69 scanned on 05/14/2018 00:02:07)\n File SHA256: cf676cd008d682ba5d21f8d2a1c323749db35228dc2ec7e060ab09fb1bb05168 (Date: 01/16/2017 20:36:27)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/67 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of the input URL","description":"Found malicious artifacts related to the input domain \"http://login.microsoftonline.com\" (IP: 104.40.240.48): ...\n File SHA256: 16433f5a6b759a51f8a9f75a2258756a2e9fd14539c99303042fb88bebe7d3cf (AV positives: 41/66 scanned on 05/21/2018 06:11:50)\n File SHA256: e3780277c15bd16ab6c1a023b2e00706b2e882a1f1cf899b7fbe554d2c73231b (AV positives: 1/69 scanned on 05/18/2018 14:39:24)\n File SHA256: 4340d283dc66d6270f17b9c9163e3202334be510b525a5525f516f3747e2fd6f (AV positives: 1/69 scanned on 05/17/2018 10:01:52)\n File SHA256: e8ade7f807c7257e1f13354f77a18e0b315cf522ba7e245c6f98ba86a0841f7e (AV positives: 1/68 scanned on 05/14/2018 23:59:30)\n File SHA256: c61d711cf40a1d0a7fc18e68b617572ad6ef5503685618ff0d9561ed6693abf7 (AV positives: 1/69 scanned on 05/14/2018 00:02:07)\n File SHA256: cf676cd008d682ba5d21f8d2a1c323749db35228dc2ec7e060ab09fb1bb05168 (Date: 01/16/2017 20:36:27)","origin":"Network Traffic","relevance":10,"id":"network-33","sources":[{"report_type":"sandbox","report_id":"5b0831f47ca3e137cb4f9fe3"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/91 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"638987da02acf22efc3c277c"},{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"},{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"widevinecdm.dll\" has type \"PE32+ executable (DLL) (console) x86-64 for MS Windows\"- Location: [%TEMP%\\7688_1529635017\\_platform_specific\\win_x64\\widevinecdm.dll]- [targetUID: 00000000-00007688]\n \"Part-RU\" has type \"DOS executable (COM)\"- Location: [%TEMP%\\7688_653247603\\Part-RU]- [targetUID: 00000000-00007688]","origin":"Binary File","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"638987da02acf22efc3c277c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"widevinecdm.dll\" has type \"PE32+ executable (DLL) (console) x86-64 for MS Windows\"- Location: [%TEMP%\\7688_1529635017\\_platform_specific\\win_x64\\widevinecdm.dll]- [targetUID: 00000000-00007688]\n \"Part-RU\" has type \"DOS executable (COM)\"- Location: [%TEMP%\\7688_653247603\\Part-RU]- [targetUID: 00000000-00007688]","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"638987da02acf22efc3c277c"},{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"msedge.exe\" wrote 8192 bytes starting with PE header signature to file \"%TEMP%\\7688_1529635017\\_platform_specific\\win_x64\\widevinecdm.dll\": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0a00 ...","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"638987da02acf22efc3c277c"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"10.34.0.32\" found in string \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Subresource Filter\\Indexed Rules\\35\\10.34.0.32\"\n Potential IP \"10.34.0.32\" found in string \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Subresource Filter\\Unindexed Rules\\10.34.0.32\\LICENSE\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"638987da02acf22efc3c277c"},{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"$27","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-93","sources":[{"report_type":"sandbox","report_id":"638987da02acf22efc3c277c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"$28","origin":"Binary File","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"638987da02acf22efc3c277c"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 152.199.4.44 on port 443 is sent without HTTP header\n TCP traffic to 52.96.31.178 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"1/72 Antivirus vendors marked dropped file \"ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73_1_.svg\" as malicious (classified as \"Unavailable\" with 1% detection rate)\n 1/70 Antivirus vendors marked dropped file \"ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c_1_.svg\" as malicious (classified as \"No error\" with 1% detection rate)\n 1/72 Antivirus vendors marked dropped file \"microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd_1_.svg\" as malicious (classified as \"Unavailable\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5eac5900af94915c7331e92e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"identity_helper.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002740)\n \"identity_helper.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00002740)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"identity_helper.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI)\" (SID: 2047866, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"$2c","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 83160000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 82730000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 84420000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"identity_helper.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"identity_helper.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\")\n \"identity_helper.exe\" touched \"Property System Apartment Class Factory\" (Path: \"HKCU\\CLSID\\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}\")\n \"identity_helper.exe\" touched \"ShellItem Shell Namespace helper\" (Path: \"HKCU\\CLSID\\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\")\n \"identity_helper.exe\" touched \"Windows Push Notification Developer Proxy Stub\" (Path: \"HKCU\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}\")\n \"identity_helper.exe\" touched \"Windows Search Manager\" (Path: \"HKCU\\CLSID\\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"\"superantispyware.recurly.com\",\" (Indicator: \"superantispyware\") in Source: wallet-checkout-eligible-sites.json\n \"\"totaldefense.com\",\" (Indicator: \"totaldefense\") in Source: wallet-checkout-eligible-sites.json\n \"\"mcafee.com\"\" (Indicator: \"mcafee\") in Source: wallet-checkout-eligible-sites.json","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"aadcdn.msauth.net\"\n \"aadcdn.msftauth.net\"\n \"bzib.nelreports.net\"\n \"clients2.google.com\"\n \"clients2.googleusercontent.com\"\n \"www.bing.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6554db1146d9fddc6a024b9c"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; File: \"shopping_fre.html\")\n Found string \"