34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 54:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4a5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 964005e54ecd… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample 964005e54ecd…. Threat score 35/100. 0/25 AV engines flagged this file. 2 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee"],"about":{"@type":"SoftwareApplication","name":"External Disbursement Discrepancies (CRPS) 11042026 1 Exception Item(s) on Ferc Batch Entry - Possible Return on 11062026_STMT_FERC212359033529337997255.pdf","applicationCategory":["pdf"],"identifier":"964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":25},"behavioralIndicators":{"malicious":2,"suspicious":3},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Ta70,"identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7AB93C52-0E48-4750-BA9D-1A4113981847}\PROXYSTUBCLSID32") "identity_helper.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7AB93C52-0E48-4750-BA9D-1A4113981847}\PROXYSTUBCLSID32") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{7AB93C52-0E48-4750-BA9D-1A4113981847}\PROXYSTUBCLSID32") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{7AB93C52-0E48-4750-BA9D-1A4113981847}\PROXYSTUBCLSID32") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{5CADDC63-01D3-4C97-986F-0533483FEE14}\PROXYSTUBCLSID32") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{5CADDC63-01D3-4C97-986F-0533483FEE14}\PROXYSTUBCLSID32") "identity_helper.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{5CADDC63-01D3-4C97-986F-0533483FEE14}\PROXYSTUBCLSID32") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{5CADDC63-01D3-4C97-986F-0533483FEE14}\PROXYSTUBCLSID32") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{3BC3D253-2F31-4092-9129-8AD5ABF067DA}\PROXYSTUBCLSID32") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3BC3D253-2F31-4092-9129-8AD5ABF067DA}\PROXYSTUBCLSID32") "identity_helper.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3BC3D253-2F31-4092-9129-8AD5ABF067DA}\PROXYSTUBCLSID32") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{3BC3D253-2F31-4092-9129-8AD5ABF067DA}\PROXYSTUBCLSID32") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}\TREATAS") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}\TREATAS") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}\INPROCSERVER32") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}\INPROCSERVER32") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}\INPROCHANDLER32") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}\INPROCHANDLER32") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}\INPROCHANDLER") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}\INPROCHANDLER")37:T77b,"identity_helper.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004924) "identity_helper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004924) "identity_helper.exe" called "RtlGetVersion" with parameter 240100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004924)38:T809,Submission context: "You don't often get email from info@pointtopointlimo.com. Learn why this is important Caution: This message does not originate from a known FERC email system. Use caution if this message contains attachments, links or requests for information. Hello,A secure message was shared with you. Please follow the instructions in the 'OTP' file, and use the one time password.You will be prompted to enter the one-time password (OTP) to access the messageFile expiry: This message will be available for one day from the date of this email, after which it will be automatically deleted.Status: New file available for review. Uploaded on: 4th, November 2026.If you require assistance opening this message, please reach out directly to support using the contact information provided in the secure message.Go Green: Consider the environment before printing this e-mail.fr De: Ana Murillo Zavaleta Enviado: jueves, 25 de enero de 2024 18:59 Para: Hector Daniel Alcantara Magana Asunto: Re: Cambio de horario No suele recibir correos electrnicos de anaemurza@gmail.com. Por qu esto es importante [Correo Externo] Cuidado con links o archivos adjuntos. Dudas a helpdesk@ipade.mx Hola Hctor, Yo en ese horario estoy baando y durmiendo a mi beb. No voy a poder entrar a ninguna sesin en vivo. Van a quedar grabadas ? O como puedo sacar el mejor provecho ahora? Saludos, Ana M El 25 ene 2024, a la(s) 17:00, Hector Daniel Alcantara Magana escribi: Estimado participante, El motivo del presente es para comunicarte que derivado de situaciones de fuerza mayor nos vemos obligados a reprogramar las sesiones de webinar y tutoras originalmente agendadas los mircoles y jueves de 08:00 a 09:20 horario Ciudad de Mxico, siendo cambiadas a mircoles y jueves de 18:00 a 19:20 horario Ciudad de Mxico Sabemos las implicaciones que esto puede ocasionar y lamentamos los inconvenientes. Quedamos abiertos a cualquier duda que pueda surgir de este cambio. Equipo de Programa Innovacin financiera en la era digital."39:T7a2,"identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004924) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004924) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004924) "identity_helper.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004924) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004924) "identity_helper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004924) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004924) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004924) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004924) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00004924) "identity_helper.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Edge\Application\145.0.3800.58\msedge.dll (UID: 00000000-00004924) "identity_helper.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004924) "identity_helper.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004924) "identity_helper.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004924) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004924) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004924) "identity_helper.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004924)3a:T1926,"identity_helper.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter RtlGetDeviceFamilyInfoEnum (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter PrefetchVirtualMemory (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter ChromeMain (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsGetStringRawBuffer (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004924) "identity_helper.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004924)3b:T1527,"\Registry\Machine\Software\Classes\Directory\ShellEx\PropertyHandler" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{D81E96F1-A89C-417E-9335-59531026309D}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{EFE869FC-5841-55F1-AA56-82C7219AAA09}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{350E1244-4575-45EE-8595-0AA8C6506FC7}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "istry\Machine\Software\Classes\WOW6432Node\CLSID\{53067330-01CE-4027-947F-FF8580E92463}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "NUMBER_OF_PROCESSORS\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "Microsoft\Edge\Application;C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\HAPUBWS\AppData\Roaming\nvm;%NVM_SYMLINK%;C:\WINDOWS\System32\OpenSSH\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmproxy\bin;C:\Users\HAPUBWS\AppData\Roami\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{53067330-01CE-4027-947F-FF8580E92463" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp 00000000-00004924.00000001.205324.87E77000.00000004.mdmp 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "EDGE_\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "EDGE_METRICS\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "PATHEXT=.COM;.\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp3c:T973,Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3848:168:WilStaging_02" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Acrobat Instance Mutex" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3848:168:WilStaging_02" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3848:64:WilError_03" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\DirectSound DllMain mutex (0x00000F08)" Process AcroRd32.exe created mutex with name "SM0:3848:64:WilError_03" Process AcroRd32.exe created mutex with name "Local\SM0:3848:168:WilStaging_02" Process AcroRd32.exe created mutex with name "SM0:3848:168:WilStaging_02" Process AcroRd32.exe created mutex with name "DirectSound DllMain mutex (0x00000F08)" Process AcroRd32.exe created mutex with name "Acrobat Instance Mutex" Process AcroRd32.exe created mutex with name "{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCEOBHIAPAAAAA" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCEOBHIAPAAAAA" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7468:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7468:120:WilError_03" Process msedge.exe created mutex with name "3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD" Process msedge.exe created mutex with name "SM0:7468:120:WilError_03" Process msedge.exe created mutex with name "SmartScreenRemoteDatacustomSettings89d47eac7d371e27ad1c015a51345530" Process msedge.exe created mutex with name "SmartScreenRemoteDataedgeSettings89d47eac7d371e27ad1c015a51345530" Process msedge.exe created mutex with name "Local\SM0:7468:304:WilStaging_02" Process msedge.exe created mutex with name "SmartScreenRemoteDatatopTraffic89d47eac7d371e27ad1c015a51345530" Process msedge.exe created mutex with name "SmartScreenLocalDatauriCache81451acec151ac953ae7f58ed54c5dd3" Process msedge.exe created mutex with name "SM0:7468:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:7468:120:WilError_03" Process msedge.exe created mutex with name "__OMADM_NAMED_MUTEX__" Process msedge.exe created mutex with name "SmartScreenRemoteDatawarnStateCache81451acec151ac953ae7f58ed54c5dd3"3d:T25f3,"\Registry\Machine\Software\Classes\Directory\ShellEx\PropertyHandler" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{D81E96F1-A89C-417E-9335-59531026309D}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{EFE869FC-5841-55F1-AA56-82C7219AAA09}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{350E1244-4575-45EE-8595-0AA8C6506FC7}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp "istry\Machine\Software\Classes\WOW6432Node\CLSID\{53067330-01CE-4027-947F-FF8580E92463}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp "NUMBER_OF_PROCESSORS\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp "Microsoft\Edge\Application;C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\HAPUBWS\AppData\Roaming\nvm;%NVM_SYMLINK%;C:\WINDOWS\System32\OpenSSH\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmproxy\bin;C:\Users\HAPUBWS\AppData\Roami\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{53067330-01CE-4027-947F-FF8580E92463" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp "EDGE_\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000000.204769.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp "EDGE_METRICS\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp "PATHEXT=.COM;.\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp "\Registry\Machine\Software\Classes\Directory\ShellEx\PropertyHandler" in Source: 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{D81E96F1-A89C-417E-9335-59531026309D}" in Source: 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{EFE869FC-5841-55F1-AA56-82C7219AAA09}" in Source: 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}" in Source: 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}" in Source: 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{350E1244-4575-45EE-8595-0AA8C6506FC7}" in Source: 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}" in Source: 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager" in Source: 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "istry\Machine\Software\Classes\WOW6432Node\CLSID\{53067330-01CE-4027-947F-FF8580E92463}" in Source: 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "NUMBER_OF_PROCESSORS\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "Microsoft\Edge\Application;C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\HAPUBWS\AppData\Roaming\nvm;%NVM_SYMLINK%;C:\WINDOWS\System32\OpenSSH\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmproxy\bin;C:\Users\HAPUBWS\AppData\Roami\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{53067330-01CE-4027-947F-FF8580E92463" in Source: 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "EDGE_\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000001.205324.87E77000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}" in Source: 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "EDGE_METRICS\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "PATHEXT=.COM;.\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046" in Source: 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00004924.00000001.205324.D1801000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00004924.00000001.205324.D1801000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00004924.00000001.205324.D1801000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00004924.00000001.205324.D1801000.00000002.mdmp "Software\" in Source: 00000000-00004924.00000001.205324.D1801000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00004924.00000001.205324.D1801000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00004924.00000001.205324.D1801000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00004924.00000001.205324.D1801000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004924.00000001.205324.D1801000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004924.00000001.205324.E9070000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00004924.00000001.205324.E9070000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004944.00000000.204444.E9070000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00004944.00000000.204444.E9070000.00000002.mdmp3e:Tf92,"identity_helper.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffbe1ef0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffbf9930000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffbf9930000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffbf9930000 "identity_helper.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffbf9dc0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffbf9930000 "identity_helper.exe" loaded module "KERNEL32" at base 7ffbfa220000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffbf9930000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffbf9930000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffbf9930000 "identity_helper.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 7ffbfa8a0000 "identity_helper.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGE\APPLICATION\145.0.3800.58\MSEDGE.DLL" at base 7ffbb23c0000 "identity_helper.exe" loaded module "ADVAPI32.DLL" at base 7ffbfbc90000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffbf6e60000 "identity_helper.exe" loaded module "USER32.DLL" at base 7ffbfae10000 "identity_helper.exe" loaded module "SHELL32.DLL" at base 7ffbfb4c0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffbfa2f0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffbfa2f0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WPNAPPS.DLL" at base 7ffbe0080000 "identity_helper.exe" loaded module "RPCRT4.DLL" at base 7ffbfa9f0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffbf22a0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffbfa2f0000 "identity_helper.exe" loaded module "OLE32.DLL" at base 7ffbf9f60000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\EXECMODELCLIENT.DLL" at base 7ffbe2a00000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.APPCORE.DLL" at base 7ffbf30a0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.APPLICATIONMODEL.DLL" at base 7ffbe45e0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffbf9dc0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTOWINRT.DLL" at base 7ffbe5cb0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 7ffbe64c0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffbf5aa0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\EXECMODELPROXY.DLL" at base 7ffbe0c80000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\TILEDATAREPOSITORY.DLL" at base 7ffbe0500000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\USERMGRPROXY.DLL" at base 7ffbf0b50000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffbe53f0000 "identity_helper.exe" loaded module "NTDLL.DLL" at base 7ffbfbe30000 "identity_helper.exe" loaded module "GDI32.DLL" at base 7ffbfa870000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.INTERNAL.SHELL.BROKER.DLL" at base 7ffbdb200000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\PCSHELLCOMMONPROXYSTUB.DLL" at base 7ffbdc890000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\STARTTILEDATA.DLL" at base 7ffbdf770000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\BIWINRT.DLL" at base 7ffbdb3b0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.APPLICATIONDATA.DLL" at base 7ffbdbc70000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffbf3970000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffbf75500003f:T1e90,Process "msedge.exe" (UID: 00000000-00007468) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "msedge.exe" (UID: 00000000-00007468) was launched with modified environment variables: "PSModulePath, Path, PATHEXT" Process "msedge.exe" (UID: 00000000-00007468) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, PROMPT, FPS_BROWSER_USER_PROFILE_STRING" Process "msedge.exe" (UID: 00000000-00007920) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_7468_YVHUQROWFJVYYKPA", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="7468"" Process "msedge.exe" (UID: 00000000-00002920) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="12", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00004248) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00003988) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="jP4rha1uIrhuQMz", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="12", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="6qxBkOV", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", NODE_PATH="%PROGRAMFILES%\nodejs\node_modules", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", OS="Windows_NT", COMPUTERNAME="jP4rha1uIrhuQMz", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\6qxBkOV", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\6qxBkOV", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00001072) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "identity_helper.exe" (UID: 00000000-00004944) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="jP4rha1uIrhuQMz", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="12", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="6qxBkOV", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", NODE_PATH="%PROGRAMFILES%\nodejs\node_modules", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", OS="Windows_NT", COMPUTERNAME="jP4rha1uIrhuQMz", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\6qxBkOV", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\6qxBkOV", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00004408) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00000740) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="jP4rha1uIrhuQMz", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="12", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="6qxBkOV", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", NODE_PATH="%PROGRAMFILES%\nodejs\node_modules", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", OS="Windows_NT", COMPUTERNAME="jP4rha1uIrhuQMz", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\6qxBkOV", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\6qxBkOV", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753""40:T8d7,Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00007468) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00007920), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00002920), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003200), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004248), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00005280), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00002236), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00003988), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00002976), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00001072), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00004396), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00004944), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00004408), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00000740), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00004924), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00002888)41:T8d7,Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00007468) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00007920), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00002920), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003200), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00004248), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00005280), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00002236), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00003988), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00002976), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00001072), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00004396), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00004944), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00004408), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00000740), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00004924), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00002888)42:T10d4,The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 76:7A:3B:FA:D0:F8:92:94:22:AC:46:9B:F5:92:44:E3:9B:62:43:32; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 9C:FF:31:B5:1D:22:B9:BF:D3:80:8A:8C:35:B4:BB:DF:36:13:71:F0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: 27:E6:66:32:99:D3:40:DF:E5:45:71:CE:CC:EC:01:BE:74:49:5D:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G3 TLS ECC SHA384 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 8C:3F:A5:74:CB:50:76:53:00:E4:24:A1:F7:7C:85:30:87:4F:8E:4D; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 95:77:F9:1F:E8:6C:27:D9:91:21:29:73:0E:81:66:37:3F:C2:EE:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: AA:BD:85:9A:77:31:8E:0D:DF:97:C7:57:71:23:D4:36:8D:B7:31:F5; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M04, O=Amazon, C=US" (SHA1: E7:26:0D:F0:1C:8D:4A:F7:5D:16:41:FB:C8:4E:3A:04:86:AD:99:8A; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon Root CA 1, O=Amazon, C=US" (SHA1: E7:B8:B5:A6:74:3C:E1:B2:F1:7B:04:1D:E5:95:58:A4:14:72:D7:0C; see report for more information) The input sample is signed with a certificate issued by "CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 06:B2:59:27:C4:2A:72:16:31:C1:EF:D9:43:1E:64:8F:A6:2E:1E:39; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 7E:9B:0B:64:0F:E9:7B:DD:92:F4:5A:F3:DF:89:50:51:E2:3F:3C:30; see report for more information) The input sample is signed with a certificate issued by "CN=YR1, O=Let's Encrypt, C=US" (SHA1: C2:73:10:A1:69:41:B6:D6:65:59:03:2F:5B:10:55:D4:23:B5:6D:D3; see report for more information) The input sample is signed with a certificate issued by "CN=Root YR, O=ISRG, C=US" (SHA1: CB:CF:D0:9C:E3:CD:22:D9:9D:94:E5:8F:92:E9:89:8F:BE:E5:1A:5E; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 08:71:1E:94:28:F2:FC:99:F8:90:A9:FF:F8:30:1A:DD:BA:D7:28:83; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=YE2, O=Let's Encrypt, C=US" (SHA1: DA:3D:A0:CE:67:4E:5C:08:D3:81:A0:B2:92:9A:89:8C:F4:DB:D1:B5; see report for more information)43:T527,"GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.baltimoreravens.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: www.napa-net.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image"44:T7ab,"AdobeFnt14.lst.3848" has type "PostScript document text"- [targetUID: 00000000-00003848] "A9Roq6zof_mxe80n_2yw.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Roq6zof_mxe80n_2yw.tmp]- [targetUID: 00000000-00003848] "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00003848] "A9Rk8fm0l_mxe80p_2yw.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rk8fm0l_mxe80p_2yw.tmp]- [targetUID: 00000000-00003848] "Annssi.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00003848] "Annss.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00003848] "addressbook.acrodata" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00003848] "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" has type " sha1WithRSAEncryption countryName=US"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00003848] "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00003848] "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" has type " sha1WithRSAEncryption countryName=US"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00003848] "Annssk.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00003848] "FAP4594.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\FAP4594.tmp]- [targetUID: 00000000-00003848]45:T961,"identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}\PROXYSTUBCLSID32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}\PROXYSTUBCLSID32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}\"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.SYSTEM.INTERNAL.USERMANAGER"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.SYSTEM.INTERNAL.USERMANAGER\CUSTOMATTRIBUTES"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\USERMANAGER"; Key: ""; Value: "") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\USERMANAGER\CUSTOMATTRIBUTES"; Key: ""; Value: "")46:T1053,"identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}\PROXYSTUBCLSID32"; Key: ""; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}"; Key: "DATA"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}"; Key: "GENERATION"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.SYSTEM.INTERNAL.USERMANAGER"; Key: "ACTIVATIONTYPE"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.SYSTEM.INTERNAL.USERMANAGER"; Key: "SERVER"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.SYSTEM.INTERNAL.USERMANAGER"; Key: "DLLPATH"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.SYSTEM.INTERNAL.USERMANAGER"; Key: "THREADING"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.SYSTEM.INTERNAL.USERMANAGER"; Key: "TRUSTLEVEL"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.SYSTEM.INTERNAL.USERMANAGER"; Key: "REMOTESERVER"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.SYSTEM.INTERNAL.USERMANAGER"; Key: "ACTIVATEASUSER"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.SYSTEM.INTERNAL.USERMANAGER"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.SYSTEM.INTERNAL.USERMANAGER"; Key: "ACTIVATEINBROKERFORMEDIUMILCONTAINER"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.SYSTEM.INTERNAL.USERMANAGER"; Key: "PERMISSIONS"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.SYSTEM.INTERNAL.USERMANAGER"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\USERMANAGER"; Key: "EXEPATH"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\USERMANAGER"; Key: "COMMANDLINE"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\USERMANAGER"; Key: "IDENTITYTYPE"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\USERMANAGER"; Key: "PERMISSIONS"; Value: "") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\USERMANAGER"; Key: "ACTIVATABLECLASSES"; Value: "")47:T673,"identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\msedge_elf.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\dbghelp.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\dbghelp.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\WINMM.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\WINMM.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\FLTLIB.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\FLTLIB.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\MSVCP140.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\VCRUNTIME140.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\VCRUNTIME140_1.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\CRYPTSP.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.58\CRYPTSP.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\RMCLIENT.dll"48:T627,Found http requests in header "GET /v1/eus007/8555bc88-d2ea-4f65-86d4-5cd980a64507/8927a1c0-bb80-4c98-a79b-e7c7ef7435f0_2250.mp4" Found http requests in header "GET /v1/eus012/de932785-1c72-4fda-bb2f-bcdb570097b0/9823596c-1fc7-4c03-b824-ecfb02a17012_2250.mp4" Found http requests in header "GET /favicon?url=exclaim.ca?w=32&h=32&q=100&m=6&f=webp&u=t" Found http requests in header "GET /favicon?url=rollingstonesdata.com?w=32&h=32&q=100&m=6&f=webp&u=t" Found http requests in header "GET /favicon?url=jaguars.com?w=32&h=32&q=100&m=6&f=webp&u=t" Found http requests in header "GET /favicon?url=pressboxonline.com?w=32&h=32&q=100&m=6&f=webp&u=t" Found http requests in header "GET /favicon?url=kvom.com?w=32&h=32&q=100&m=6&f=webp&u=t" Found http requests in header "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t" Found http requests in header "GET /" Found http requests in header "GET /favicon?url=drugstorenews.com?w=32&h=32&q=100&m=6&f=webp&u=t" Found http requests in header "GET /favicon?url=cybernews.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t" Found http requests in header "GET /favicon?url=pulse2.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t" Found http requests in header "GET /favicon?url=citybiz.co?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t" Found http requests in header "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t" Found http requests in header "GET /favicon?url=global-benefits-vision.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"49:T4b6,Pattern match: "https://aka.ms/learnaboutsenderidentification" Pattern match: "https://www.verisign.com/rpa" Pattern match: "www.adobe.com/misc/pki/prod_svce_cps.html0http://crl.adobe.com/cds\.crl0z0x1us1#0!adobe" Heuristic match: "prod-streaming-video-msn-com.akamaized.net" Pattern match: "https://ntp.msn.com/accept-language" Heuristic match: "services.bingapis.com" Pattern match: "www.baltimoreravens.com" Pattern match: "www.digitalcommerce360.com" Pattern match: "www.budgetseniors.com" Pattern match: "www.napa-net.org" Heuristic match: "clients2.googleusercontent.com" Heuristic match: "edge-consumer-static.azureedge.net" Heuristic match: "r.msftstatic.com" Heuristic match: "sb.scorecardresearch.com" Heuristic match: "blink.net" Pattern match: "http://schemas.microsoft.com/start/2014/layoutmodification" Heuristic match: "string.prototype.at" Heuristic match: "%typedarray%.prototype.at" Heuristic match: ",ak.jo" Heuristic match: "xk-.gi" Heuristic match: "fo.mr" Heuristic match: "9h.gn" Heuristic match: "%t.ke" Heuristic match: "*0.bv" Heuristic match: "lq.ro" Heuristic match: "$%.aw" Heuristic match: "g_p.cf" Heuristic match: "7o.bt" Heuristic match: "[<.tc"4a:T2d05,Found URL "https://www.office.comthumbnail" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2093703https://go.microsoft.com/fwlink/?linkid=2348603sites" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://support.google.com/chromebook?p=app_intent" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2118167" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/en-us/privacystatementyou're" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://aka.ms/edgepreviewhttps://aka.ms/enterprisepreviewuserto" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2149872an" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2165400to" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2165278https://go.microsoft.com/fwlink/?linkid=2348701https://go.microsoft.com/fwlink/?linkid=2165325https://go.microsoft.com/fwlink/?linkid=2348900use" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2239343https://go.microsoft.com/fwlink/?linkid=2288290show" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2301855allow" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2149000browsing" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2194724ai-powered" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/microsoft-edge/microsoft-edge-browsing-activity-for-personalized-advertising-and-experiences-37aa831e-6372-238e-f33f-7cd3f0e53679allow" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/microsoft-365/family-safetyhttps://family.microsoft.com/?ref=edge://settings/familysafetyhttps://go.microsoft.com/fwlink/?linkid=2127630set" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/account-billing/view-device-and-app-use-with-family-safety-activity-reporting-b7b8501e-e35c-2224-bed8-115d5da4fbafto" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/account-billing/filter-websites-and-searches-using-microsoft-family-safety-3034d91e-5efa-9fbe-1384-46009f087ccfto" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://microsoftedgetips.microsoft.com/en-us/internet" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2211966writing" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://support.microsoft.com/office/microsoft-editor-checks-grammar-and-more-in-documents-mail-and-the-web-91ecbe1b-d021-4e9e-a82e-abc4cd7163d7are" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=521839microsoft" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2279846see" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2166676learn" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://easylist.to/easylist/easylist.txtthe" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://easylist.to/index.htmlallow" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2181135adds" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2161865alerts" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://aka.ms/techscam-detection-learn-moreblock" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=529732manage" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2105403this" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2114187https://go.microsoft.com/fwlink/?linkid=2077327edit" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2121003when" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/servicesagreementmanage" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2101140change" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://aka.ms/accountsecuritylearn" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://aka.ms/synclearnmorelinkprofile" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/deployedge/edge-learnmore-reset-data-in-cloudreset" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2333202save" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2167671use" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://example.comsuper" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2257424keep" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/edge/features/real-time-video-translation?form=ma13fj&ch=1show" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://microsoft.com/en-us/edge/ai-powered/copilot-mode?form=ma140nhttps://microsoft.com/en-us/edge/ai-powered/copilot-mode?form=ma140mcopilot" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337798https://go.microsoft.com/fwlink/?linkid=2337885explore" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337628https://go.microsoft.com/fwlink/?linkid=2345959explore" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337721https://go.microsoft.com/fwlink/?linkid=2345869discover" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addons" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addonsno" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://aka.ms/edgeprintingtroubleshooting" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://aka.ms/printtroubleshootingneed" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2126235if" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://www.bing.com/new/termsofuseenhanceenhance" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://www.microsoft.com/edge/copilot-mode?form=mg0awropen" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/copilot/privacy-and-protections" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/microsoft-365-copilot/microsoft-365-copilot-privacy" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://aka.ms/whatisscarewarequick" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2107360&clcid=0x409hi," - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "http://force" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2164373" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2164373the" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addons?hl=enhttps://www.whatsapp.comhttps://www.facebook.comhttps://www.youtube.comhttps://www.outlook.com/allow" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2151738learn" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "http://example.com" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://example.com.your" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://support.google.com/chrome/a/answer/9122284" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "http://.

" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "http://," - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "http://example.com." - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/p/?linkid=2114059" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/p/\?linkid=158334https://support.microsoft.com/en-us/windows/microsoft-edge-" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/topic/protect-your-online-accounts-using-password-monitor-6f660aae-65aa-476c-871a-7fe2bcb0c4c1let's" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2193240check" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/en-us/privacystatement" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2189718protected" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/privacystatementalways" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "https://m365.cloud.microsoft/chat?fromcode=cmm63o75lj0let's" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp") Found URL "http://microsoft.com/edge/surfintroducing" - Source: "00000000-00004924.00000000.204769.8B1A0000.00000002.mdmp")4b:T2c88,GET /v1/eus007/8555bc88-d2ea-4f65-86d4-5cd980a64507/8927a1c0-bb80-4c98-a79b-e7c7ef7435f0_2250.mp4 HTTP/1.1 Host: prod-streaming-video-msn-com.akamaized.net Connection: keep-alive sec-ch-ua-platform: "Windows" Accept-Encoding: identity;q=1 *;q=0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Accept-Language: en-US en;q=0.9 Range: bytes=7536640-7589925 If-Range: "0x8DEE634904B5DFC" GET /v1/eus012/de932785-1c72-4fda-bb2f-bcdb570097b0/9823596c-1fc7-4c03-b824-ecfb02a17012_2250.mp4 HTTP/1.1 Host: prod-streaming-video-msn-com.akamaized.net Connection: keep-alive sec-ch-ua-platform: "Windows" Accept-Encoding: identity;q=1 *;q=0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Accept-Language: en-US en;q=0.9 Range: bytes=8945664-8975272 If-Range: "0x8DF11883AA9FFF8" GET /favicon?url=exclaim.ca?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=rollingstonesdata.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=jaguars.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=pressboxonline.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=kvom.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.baltimoreravens.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.digitalcommerce360.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.budgetseniors.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET / HTTP/2 Host: www.budgetseniors.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=drugstorenews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=cybernews.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=pulse2.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=citybiz.co?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: www.napa-net.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=global-benefits-vision.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image 4c:T849,Found HTTPS GET request to https://prod-streaming-video-msn-com.akamaized.net/v1/eus007/8555bc88-d2ea-4f65-86d4-5cd980a64507/8927a1c0-bb80-4c98-a79b-e7c7ef7435f0_2250.mp4 Found HTTPS GET request to https://prod-streaming-video-msn-com.akamaized.net/v1/eus012/de932785-1c72-4fda-bb2f-bcdb570097b0/9823596c-1fc7-4c03-b824-ecfb02a17012_2250.mp4 Found HTTPS GET request to https://services.bingapis.com/favicon?url=exclaim.ca?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=rollingstonesdata.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=jaguars.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=pressboxonline.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=kvom.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://www.baltimoreravens.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://www.digitalcommerce360.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://www.budgetseniors.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://www.budgetseniors.com/ Found HTTPS GET request to https://services.bingapis.com/favicon?url=drugstorenews.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=cybernews.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=pulse2.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=citybiz.co?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://www.napa-net.org/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=global-benefits-vision.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t4d:T543,Found string "F+ncalrpc:[OLE89E5A9AB4793AE34D877BD7D5AC6]" (Indicator: "ncalrpc"; Source: "00000000-00004924.00000000.204769.87E77000.00000004.mdmp, 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp, 00000000-00004924.00000001.205324.87E77000.00000004.mdmp, 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp") Found string "F+ncalrpc:[OLE81BAB1941DEEB970D997827D287B]" (Indicator: "ncalrpc"; Source: "00000000-00004924.00000000.204769.87E77000.00000004.mdmp, 00000000-00004924.00000001.205324.87E77000.00000004.mdmp") Found string "=9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00004924.00000000.204769.87E77000.00000004.mdmp, 00000000-00004924.00000001.205324.87E77000.00000004.mdmp") Found string "B+ncalrpc:[OLEF194A48E17E10A91E0845D433CFA]" (Indicator: "ncalrpc"; Source: "00000000-00004924.00000000.204769.87E77000.00000004.mdmp, 00000000-00004924.00000001.205324.87E77000.00000004.mdmp") Found string "B+ncalrpc:[OLEE7D01095422E2CCC3D1BAB2E57AD]" (Indicator: "ncalrpc"; Source: "00000000-00004924.00000000.204769.87E77000.00000004.mdmp, 00000000-00004924.00000001.205324.87E77000.00000004.mdmp") Found string "ncalrpc:" (Indicator: "ncalrpc"; Source: "00000000-00004924.00000000.204769.87E77000.00000004.mdmp, 00000000-00004924.00000001.205324.87E77000.00000004.mdmp")4e:T735,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004924.00000000.204769.00054000.00000004.mdmp, 00000000-00004924.00000000.204769.87E77000.00000004.mdmp, 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp, 00000000-00004924.00000000.204769.87F00000.00000004.mdmp, 00000000-00004924.00000001.205324.00054000.00000004.mdmp, 00000000-00004924.00000001.205324.87E77000.00000004.mdmp, 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp, 00000000-00004924.00000001.205324.87F00000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004924.00000000.204769.00054000.00000004.mdmp, 00000000-00004924.00000000.204769.87E77000.00000004.mdmp, 00000000-00004924.00000000.204769.87EB7000.00000004.mdmp, 00000000-00004924.00000000.204769.87F00000.00000004.mdmp, 00000000-00004924.00000001.205324.00054000.00000004.mdmp, 00000000-00004924.00000001.205324.87E77000.00000004.mdmp, 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp, 00000000-00004924.00000001.205324.87F00000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00004924.00000000.204769.87EB7000.00000004.mdmp, 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00004924.00000000.204769.87EB7000.00000004.mdmp, 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp") Found string "C:\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004924.00000000.204769.87EB7000.00000004.mdmp, 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp")4f:T524,Dropped file: "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00003848] Dropped file: "Annssi.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00003848] Dropped file: "Annss.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00003848] Dropped file: "addressbook.acrodata" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00003848] Dropped file: "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00003848] Dropped file: "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00003848] Dropped file: "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00003848] Dropped file: "Annssk.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00003848]50:T9e8,Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.11 on port 80 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 52.123.251.33 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.11 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 99.84.160.10 on port 443 (TCP); Domain: "sb.scorecardresearch.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.12 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.10 on port 443 (TCP); Domain: "r.msftstatic.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 151.101.1.55 on port 443 (TCP); Domain: "www.baltimoreravens.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 172.67.213.231 on port 443 (TCP); Domain: "www.budgetseniors.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 141.193.213.11 on port 443 (TCP); Domain: "www.digitalcommerce360.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.110.7 on port 443 (TCP); Domain: "edge-consumer-static.azureedge.net" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 142.251.219.46 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 142.251.214.33 on port 443 (TCP); Domain: "clients2.googleusercontent.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 23.56.109.209 on port 443 (TCP); Domain: "prod-streaming-video-msn-com.akamaized.net" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 74.151.238.134 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.73.13 on port 443 (TCP); Domain: "services.bingapis.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 104.18.40.59 on port 443 (TCP); Domain: "www.napa-net.org" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.10 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.11 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 35.190.80.1 on port 443 (UDP)51:T673b,"GET /v1/eus007/8555bc88-d2ea-4f65-86d4-5cd980a64507/8927a1c0-bb80-4c98-a79b-e7c7ef7435f0_2250.mp4 HTTP/1.1 Host: prod-streaming-video-msn-com.akamaized.net Connection: keep-alive sec-ch-ua-platform: "Windows" Accept-Encoding: identity;q=1, *;q=0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Accept-Language: en-US,en;q=0.9 Range: bytes=7536640-7589925 If-Range: "0x8DEE634904B5DFC"" Response ==> HTTP/1.1 206 Partial Content Content-Type: video/mp4 Last-Modified: Mon 20 Jul 2026 07:57:36 GMT ETag: "0x8DEE634904B5DFC" x-ms-request-id: 7f3ad5b8-401e-002c-1c9f-618710000000 x-ms-version: 2025-05-05 x-ms-meta-videofiletype: progressive x-ms-creation-time: Mon 20 Jul 2026 07:57:36 GMT x-ms-blob-content-md5: OzI0WPqRSHJdeOC4KyRtjg== x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true x-ms-access-tier: Hot x-ms-access-tier-inferred: true x-ms-last-access-time: Wed 21 Oct 2026 21:03:58 GMT Access-Control-Allow-Origin: * x-azure-ref: 20261021T210558Z-15c55f57985ghxp7hC1LAX5zqw00000001s000000000c61m x-fd-int-roxy-purgeid: 0 rule: eus007 Accept-Ranges: bytes Cache-Control: public max-age=1289810 Date: Thu 05 Nov 2026 22:49:08 GMT Content-Range: bytes 7536640-7589925/7589926 Content-Length: 53286 Connection: keep-alive with response body ==>C391C28EC2BA456859C3831AC294C28671C3995601C2BFC2B24DC397C2A33EC3AD3466C2AD1FC2A71BC2A0C3845B42C29F17677A6575475B4B1D705810C3ABC2....... "GET /v1/eus012/de932785-1c72-4fda-bb2f-bcdb570097b0/9823596c-1fc7-4c03-b824-ecfb02a17012_2250.mp4 HTTP/1.1 Host: prod-streaming-video-msn-com.akamaized.net Connection: keep-alive sec-ch-ua-platform: "Windows" Accept-Encoding: identity;q=1, *;q=0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Accept-Language: en-US,en;q=0.9 Range: bytes=8945664-8975272 If-Range: "0x8DF11883AA9FFF8"" Response ==> HTTP/1.1 206 Partial Content Content-Type: video/mp4 Last-Modified: Sun 13 Sep 2026 11:14:50 GMT ETag: "0x8DF11883AA9FFF8" x-ms-request-id: 9f2de210-a01e-00be-558f-6c41b3000000 x-ms-version: 2025-05-05 x-ms-meta-videofiletype: progressive x-ms-creation-time: Sun 13 Sep 2026 11:14:50 GMT x-ms-blob-content-md5: sZhvOgWP7l2ep6Hg9aHI9Q== x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true x-ms-access-tier: Hot x-ms-access-tier-inferred: true x-ms-last-access-time: Wed 04 Nov 2026 19:04:30 GMT Access-Control-Allow-Origin: * x-azure-ref: 20261104T190432Z-r1989676744rm6qnhC1SJCc17s00000013z0000000007rch x-fd-int-roxy-purgeid: 0 rule: eus012 Accept-Ranges: bytes Cache-Control: public max-age=2492123 Date: Thu 05 Nov 2026 22:49:09 GMT Content-Range: bytes 8945664-8975272/8975273 Content-Length: 29609 Connection: keep-alive with response body ==>19C3B5C3ABC3BB6EC2BA21C2A16CC29AC29CC2A2C2AD3DC2B258C28D21013CC299C2B7C3ACC3AB18C2975E36C38D45C3B02BC3BFC38AC3ABC2A549C38E50C3A3....... "GET /favicon?url=exclaim.ca?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 22:49:02 GMT X-Msedge-Ref: Ref A: 8BEA60ABC22F40EB97C05937189FC89A Ref B: SJC211051203023 Ref C: 2026-11-05T22:49:02Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 8BEA60ABC22F40EB97C05937189FC89A Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000I_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-JD8D9 Ref C: 2026-11-05T22:49:02Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=rollingstonesdata.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 22:49:02 GMT X-Msedge-Ref: Ref A: B2BD04F27A8044C2BE6B7B95291BF5F0 Ref B: SJC211051203023 Ref C: 2026-11-05T22:49:02Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: B2BD04F27A8044C2BE6B7B95291BF5F0 Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS000009_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-ZRML6 Ref C: 2026-11-05T22:49:02Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=jaguars.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 22:49:04 GMT X-Msedge-Ref: Ref A: 67AD55C33C3A43A5B592417804C2631C Ref B: SJC211051203023 Ref C: 2026-11-05T22:49:04Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 67AD55C33C3A43A5B592417804C2631C Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000O_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-GD5D5 Ref C: 2026-11-05T22:49:04Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=pressboxonline.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 22:49:04 GMT X-Msedge-Ref: Ref A: 9EA311FE419E451F8B076B8BAD7263E7 Ref B: SJC211051203023 Ref C: 2026-11-05T22:49:04Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 9EA311FE419E451F8B076B8BAD7263E7 Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000D_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-CSBGT Ref C: 2026-11-05T22:49:04Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=kvom.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 22:49:04 GMT X-Msedge-Ref: Ref A: 44108EDCEE3640999ECF2C32031ED1A6 Ref B: SJC211051203023 Ref C: 2026-11-05T22:49:04Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 44108EDCEE3640999ECF2C32031ED1A6 Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000Q_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-6DC84 Ref C: 2026-11-05T22:49:04Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.baltimoreravens.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Content-Type: text/html Date: Thu 05 Nov 2026 22:49:05 GMT Server: istio-envoy X-Envoy-Upstream-Service-Time: 29 Vary: Accept-Encoding X-NFL-Geo Origin X-Nfl-Dma: 501 Content-Encoding: gzip Service-Worker-Allowed: / X-Served-By: cache-iad-kcgs7200102-IAD cache-lax-kwhp1940024-LAX Strict-Transport-Security: max-age=31536000; includeSubDomains X-Cache-Hits: 2 0 Via: 1.1 varnish 1.1 varnish X-Nfl-Geo: country_code=US Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block X-Timer: S1793918945.283114 VS0 VE60 X-Cache: HIT MISS Cache-Control: public max-age=5 Accept-Ranges: bytes Age: 0 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.digitalcommerce360.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Thu 05 Nov 2026 22:49:05 GMT Server: cloudflare Cf-Ray: a55f68e13f8a251c-SJC Vary: Accept-Encoding Content-Encoding: gzip Cf-Cache-Status: HIT Access-Control-Allow-Origin: * Last-Modified: Wed 23 Sep 2026 08:41:58 GMT Set-Cookie: __cf_bm=4TxnE6jcsk.1KJWiwHW4jatIUmzseXFIfg64SrN31gk-1793918945.4834733-1.0.1.1-tOnQ8_v1qLrrTX11eDUr2whWyaqxGyww9m859qFiBniStboCrpk6Mr3.AcLmpDZw1iwOnyc_lpqS_KiB2EHNBxhHuuuDCx4OM0vpXQrLcxM9njKkChDc_4w.4bKhHWOm; HttpOnly; SameSite=None; Secure; Path=/; Domain=www.digitalcommerce360.com; Expires=Thu 05 Nov 2026 23:19:05 GMT Content-Security-Policy: frame-ancestors 'self'; Etag: W/"6ab390d6-47e" Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=86400 Age: 3189615 with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.budgetseniors.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Date: Thu 05 Nov 2026 22:49:05 GMT Server: cloudflare Cf-Ray: a55f68e13f387b83-SJC X-Redirect-By: Rank Math Cf-Edge-Cache: cache platform=wordpress Cf-Cache-Status: HIT Speculation-Rules: "/cdn-cgi/speculation" Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Location: https://www.budgetseniors.com Cf-Apo-Via: origin qs Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=heMSKUUj1LhUHRUALQmPWhpCwwF0VH2kISYvKdqqLVrbd6KjIn9Xz6GvEkC4hi3j8F6bQ4al4q3buT7852ampm5s29CXs%2B88%2FVRH3BxMhEMBx1I65qx6comtsJ%2BHReI4AlYbZOrLEGo%3D"}]} Cache-Control: max-age=14400 Alt-Svc: h3=":443"; ma=86400 Age: 842 with no response body "GET / HTTP/2 Host: www.budgetseniors.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: text/html; charset=UTF-8 Date: Thu 05 Nov 2026 22:49:05 GMT Server: cloudflare Cf-Ray: a55f68e188237b83-SJC Vary: Accept-Encoding Content-Encoding: zstd Link: ; rel="https://api.w.org/" ; rel="alternate"; title="JSON"; type="application/json" ; rel=shortlink Cf-Edge-Cache: cache platform=wordpress Cf-Cache-Status: HIT Speculation-Rules: "/cdn-cgi/speculation" Last-Modified: Thu 05 Nov 2026 11:00:10 GMT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Cf-Apo-Via: tcache Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=uGFTJ2tFwK%2FK6Jr4UdRYcsFNtrZM2hKKQXza%2BboiIpZ8cv6i3Vtnou3IpljrhPjjxwnJLx3cMOlKUcu3QIpkgn9RS3rZE%2FwCh%2BJubQOhd1r%2BFzR6g9nqzI9Nbgo0an5J9LaYNQgss5A%3D"}]} Alt-Svc: h3=":443"; ma=86400 Age: 42660 with response body ==>BINARY_CONTENT....... "GET /favicon?url=drugstorenews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 22:49:06 GMT X-Msedge-Ref: Ref A: 3736518B21634FAA8D5B211391361C2A Ref B: SJC211051203023 Ref C: 2026-11-05T22:49:06Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 3736518B21634FAA8D5B211391361C2A Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000Q_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-6DC84 Ref C: 2026-11-05T22:49:06Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=cybernews.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 22:49:43 GMT X-Msedge-Ref: Ref A: A7FB9FB8E1B846E48DCB63F7D35D3094 Ref B: BY1AA1072319029 Ref C: 2026-11-05T22:49:44Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: A7FB9FB8E1B846E48DCB63F7D35D3094 Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000T_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-TJPRH Ref C: 2026-11-05T22:49:44Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=pulse2.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 22:49:50 GMT X-Msedge-Ref: Ref A: B467E80DBAAF4C5D9BB7FBE1F03D3F0D Ref B: BY1AA1072319029 Ref C: 2026-11-05T22:49:51Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: B467E80DBAAF4C5D9BB7FBE1F03D3F0D Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000W_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-99QSK Ref C: 2026-11-05T22:49:51Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=citybiz.co?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 22:49:50 GMT X-Msedge-Ref: Ref A: 4A3C3F6CD6D34E23B6D2C03FC745E418 Ref B: BY1AA1072319029 Ref C: 2026-11-05T22:49:51Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 4A3C3F6CD6D34E23B6D2C03FC745E418 Ref B: SC-WUS2-36H23_AKS-GEN01-32749822-VMSS000000_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-QSM7N Ref C: 2026-11-05T22:49:51Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: www.napa-net.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Content-Type: text/html; charset=utf-8 Date: Thu 05 Nov 2026 22:49:52 GMT Server: cloudflare Expires: Fri 06 Nov 2026 02:49:52 GMT Cf-Ray: a55f6a03eec6ed3c-SJC Vary: accept-encoding X-Frame-Options: DENY Content-Encoding: gzip Cf-Cache-Status: BYPASS Pragma: no-cache Strict-Transport-Security: max-age=2592000 Set-Cookie: ARRAffinitySameSite=58ab58d9b799667ae93882d8a78aa80724c222b50caff2921a4976f46e05279d;Path=/;HttpOnly;SameSite=None;Secure;Domain=www.napa-net.org Request-Context: appId=cid-v1:981cdbaf-f71c-4e3a-a7b0-bbfa8f1d92ba Content-Security-Policy: default-src 'self' data: *.google.com *.googleadservices.com images.newscred.com images1.cmp.optimizely.com *.gstatic.com images2.cmp.optimizely.com *.emailmeform.com *.youtube.com *.reddit.com *.redditstatic.com *.accelevents.com *.adtrafficquality.google *.stay22.com *.vimeocdn.com *.adsafeprotected.com images3.cmp.optimizely.com *.jsdelivr.net *.bravuratechnologies.com/ images4.cmp.optimizely.com cdn.jsdelivr.net/npm/ consent.app.cookieinformation.com snap.licdn.com px.ads.linkedin.com policy.app.cookieinformation.com vimeo.com *.idio.co podcasters.spotify.com *.issuu.com *.googlesyndication.com *.buzzsprout.com *.vimeo.com unpkg.com *.googletagservices.com *.azure.com *.googletagmanager.com *.google-analytics.com analytics.google.com *.atlassian.net *.episerver.net *.livehelpnow.net *.optimizely.com *.doubleclick.net *.visualstudio.com *.cloudfront.net *.soundcloud.com *.buzzsprout.com *.datatables.net *.cloudflare.com *.spotify.com *.higherlogic.com *.jquery.com *.personifycloud.com 'unsafe-inline' 'unsafe-eval' https://d1igp3oop3iho5.cloudfront.net/v2/mnaE2wMn0ApQFTAYD-Juaw/zaius-min.js *.zaius.com *.amazonaws.com/zaius-content/web/ *.usaretirement.org *.asppa-net.org *.napa-net.org *.ntsa-net.org widget.socio.events *.psca.org analytics.google.com wss://app.livehelpnow.net; frame-ancestors 'self'; form-action 'self' *.usaretirement.org *.asppa-net.org *.napa-net.org *.ntsa-net.org *.psca.org *.personifycloud.com *.site.com *.document360.io askerisa.org; font-src 'self' *.usaretirement.org cdnjs.cloudflare.com *.asppa-net.org *.napa-net.org *.ntsa-net.org *.psca.org *.livehelpnow.net unpkg.com data:; X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Cache-Control: public max-age=14400 Alt-Svc: h3=":443"; ma=86400 with response body ==>BINARY_CONTENT....... "GET /favicon?url=global-benefits-vision.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 22:49:51 GMT X-Msedge-Ref: Ref A: C1B422DE71A344708497C01DC74076BD Ref B: BY1AA1072319029 Ref C: 2026-11-05T22:49:52Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: C1B422DE71A344708497C01DC74076BD Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS000009_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-ZRML6 Ref C: 2026-11-05T22:49:52Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT.......52:T5a0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD/klEQVR4Xu2VXWibVRjHX4W2XtjUUtBtxmyKY1tdkV1MZFLwxumtIHqhRRT0QrzRTmjXMbdBQahbgpqVripWL1bDqpurYtOyYbYuH21X1tk0azBpu3xK06Rt+v3x930OnOy8J3mTRtiV/uFHcvImz+85z8mbKMr/2WKi0SgikQjC4TAjFAploDVdI+h9sViMPZ+cnIRcJysXn3wW9wOSe71eTE1NobGxUb+Rzl01+OX5lzT0f3CEIa77Xn0r6316UM1gMAin0wkKNaPbRIfpGZzfWaOBJ+n1oavmUGYduHBJc50if5agmoFAINMARfc4zj2xDz/s3K+BQo9T9iu4ZT7L1vY33kE6FMaN+qbMdT2opjgBHr/fn93EF4/vwbdqxyIU26HDSKgTcJ/8jK3p9WGzlSFG/ixBNakBl8uleS/F5/Npm2jZsRttasciPLe/+T6zpseI04OrHx9l68uvv82QP0tQzYmJCQwNDcFms8FiscBqtcJut2N2dhZjY2P3mmje/jSsxr0aKPKacuvrjpzXZagmnfn4+Di6u7vR3t7OmmhubobZbGa3aaaB49uegkUdWT4uvFaH1n0Hs17Xg2pSA/F4nB0FjX1kZARutxsOh4PdnpkGGh7dhfsB3f8zMzNIJpOMVCqFRCLBfrQ0E6isrER5eXleysrK4PF4GLQL/pwzMDAAx4OluLanGs76TzA6Osp+CUU5nf3c3Bxjfn7+XgNGoxFVVVV5KSkpYSPVg3Y7/EApfB8dgf+0mf0cT09PM3EueTqdzr4dC4XGpweN+k9DFcb2H0D08q8acS75wsJC8Q2QRA8a8+0XXoRbKUX82vWcYlH+rxrg5ynDd3unoQkOpUxXzOWLi4sMuX7BcJEM36234RjsykP4q/VcTjGXLy0tMeT6BcNFInynxO+Gx9Br2o0elZR6q8liUb68vFx8A6JMHvFw43H8bNiGyA0XflIf+998V1dMrKysFN8Al8njTaq7/dGwHYNHTzBp2OnGeXV9seY5+G1dDPexU7jZYkHUM8jkq6urxTfAheJoCbcq7jTtRdjlgavpJC7VHkab8jCjVeWsUo7vTNXoqXtP/aesRrD3KtbW1opvQJTy0YZUqVUVEF21L6O/6RQCPX2Yi8XZqIO9V/Bb3ftoU/+iWxQDLBVGhAdvYn19vfgGxPNMRWPo+7AeZ9SinbWvZM6Wny+HRk3Qjon0dILJNzY2im+Af4nuugfxlTrK0+puiL/v+HNKRTFJuZjY3NwsvgEuOKOO81OlgjHQ3qERilI9MUGR6xcMF5yoMKFBeQR/fP5lllCU6ol55PoFI4vyCUWpLOaR6xeMKMol3IpUjFy/YPLJtioVI9f/7+YfMhfXVn7gbsAAAAAASUVORK5CYII=53:T5a0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD/klEQVR4Xu2VXWibVRjHX4W2XtjUUtBtxmyKY1tdkV1MZFLwxumtIHqhRRT0QrzRTmjXMbdBQahbgpqVripWL1bDqpurYtOyYbYuH21X1tk0azBpu3xK06Rt+v3x930OnOy8J3mTRtiV/uFHcvImz+85z8mbKMr/2WKi0SgikQjC4TAjFAploDVdI+h9sViMPZ+cnIRcJysXn3wW9wOSe71eTE1NobGxUb+Rzl01+OX5lzT0f3CEIa77Xn0r6316UM1gMAin0wkKNaPbRIfpGZzfWaOBJ+n1oavmUGYduHBJc50if5agmoFAINMARfc4zj2xDz/s3K+BQo9T9iu4ZT7L1vY33kE6FMaN+qbMdT2opjgBHr/fn93EF4/vwbdqxyIU26HDSKgTcJ/8jK3p9WGzlSFG/ixBNakBl8uleS/F5/Npm2jZsRttasciPLe/+T6zpseI04OrHx9l68uvv82QP0tQzYmJCQwNDcFms8FiscBqtcJut2N2dhZjY2P3mmje/jSsxr0aKPKacuvrjpzXZagmnfn4+Di6u7vR3t7OmmhubobZbGa3aaaB49uegkUdWT4uvFaH1n0Hs17Xg2pSA/F4nB0FjX1kZARutxsOh4PdnpkGGh7dhfsB3f8zMzNIJpOMVCqFRCLBfrQ0E6isrER5eXleysrK4PF4GLQL/pwzMDAAx4OluLanGs76TzA6Osp+CUU5nf3c3Bxjfn7+XgNGoxFVVVV5KSkpYSPVg3Y7/EApfB8dgf+0mf0cT09PM3EueTqdzr4dC4XGpweN+k9DFcb2H0D08q8acS75wsJC8Q2QRA8a8+0XXoRbKUX82vWcYlH+rxrg5ynDd3unoQkOpUxXzOWLi4sMuX7BcJEM36234RjsykP4q/VcTjGXLy0tMeT6BcNFInynxO+Gx9Br2o0elZR6q8liUb68vFx8A6JMHvFw43H8bNiGyA0XflIf+998V1dMrKysFN8Al8njTaq7/dGwHYNHTzBp2OnGeXV9seY5+G1dDPexU7jZYkHUM8jkq6urxTfAheJoCbcq7jTtRdjlgavpJC7VHkab8jCjVeWsUo7vTNXoqXtP/aesRrD3KtbW1opvQJTy0YZUqVUVEF21L6O/6RQCPX2Yi8XZqIO9V/Bb3ftoU/+iWxQDLBVGhAdvYn19vfgGxPNMRWPo+7AeZ9SinbWvZM6Wny+HRk3Qjon0dILJNzY2im+Af4nuugfxlTrK0+puiL/v+HNKRTFJuZjY3NwsvgEuOKOO81OlgjHQ3qERilI9MUGR6xcMF5yoMKFBeQR/fP5lllCU6ol55PoFI4vyCUWpLOaR6xeMKMol3IpUjFy/YPLJtioVI9f/7+YfMhfXVn7gbsAAAAAASUVORK5CYII=30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1793919410043,"unified_at":"2026-11-05T22:56:50.043Z","metadata":{"hashes":{"sha256":"964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","sha1":"9f49f5198234769675e45f171a2a31ba272f14ef","md5":"c21ed1e9a9ce51ea9d17b1f093203e4d","sha512":"12887bba4fd706c6db17832886f93d6c969624ab63dcfcd595012baa4e4e2cf222f962f5fcb4897e5bac2d957e2ca01f6ae3408a3fbd3c4d965b5377cbf77749","ssdeep":"1536:Fx+x9nMmkuPi/inCoGUW3IsN/JDbbHn6kU5ka/BS:yLnRkuq/i4IsFJbH6kU//BS","ssdeep_chunks":["1536:Fx+x9nM","1536:x+x9nMm","1536:+x9nMmk","1536:x9nMmku","1536:9nMmkuP","1536:nMmkuPi","1536:MmkuPi/","1536:mkuPi/i","1536:kuPi/in","1536:uPi/inC","1536:Pi/inCo","1536:i/inCoG","1536:/inCoGU","1536:inCoGUW","1536:nCoGUW3","1536:CoGUW3I","1536:oGUW3Is","1536:GUW3IsN","1536:UW3IsN/","1536:W3IsN/J","1536:3IsN/JD","1536:IsN/JDb","1536:sN/JDbb","1536:N/JDbbH","1536:/JDbbHn","1536:JDbbHn6","1536:DbbHn6k","1536:bbHn6kU","1536:bHn6kU5","1536:Hn6kU5k","1536:n6kU5ka","1536:6kU5ka/","1536:kU5ka/B","1536:U5ka/BS","3072:Fx+x9nM","3072:x+x9nMm","3072:+x9nMmk","3072:x9nMmku","3072:9nMmkuP","3072:nMmkuPi","3072:MmkuPi/","3072:mkuPi/i","3072:kuPi/in","3072:uPi/inC","3072:Pi/inCo","3072:i/inCoG","3072:/inCoGU","3072:inCoGUW","3072:nCoGUW3","3072:CoGUW3I","3072:oGUW3Is","3072:GUW3IsN","3072:UW3IsN/","3072:W3IsN/J","3072:3IsN/JD","3072:IsN/JDb","3072:sN/JDbb","3072:N/JDbbH","3072:/JDbbHn","3072:JDbbHn6","3072:DbbHn6k","3072:bbHn6kU","3072:bHn6kU5","3072:Hn6kU5k","3072:n6kU5ka","3072:6kU5ka/","3072:kU5ka/B","3072:U5ka/BS","1536:yLnRkuq","1536:LnRkuq/","1536:nRkuq/i","1536:Rkuq/i4","1536:kuq/i4I","1536:uq/i4Is","1536:q/i4IsF","1536:/i4IsFJ","1536:i4IsFJb","1536:4IsFJbH","1536:IsFJbH6","1536:sFJbH6k","1536:FJbH6kU","1536:JbH6kU/","1536:bH6kU//","1536:H6kU//B","1536:6kU//BS"],"imphash":"Unknown"},"file_info":{"file_name":"External Disbursement Discrepancies (CRPS) 11042026 1 Exception Item(s) on Ferc Batch Entry - Possible Return on 11062026_STMT_FERC212359033529337997255.pdf","file_type":["pdf"],"file_type_id":"pdf","file_size":56868,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793918791000,"last_seen":1793918791000,"last_multi_scan":1793918791000},"additional_metadata":[{"name":"pdf","type":"obj","values":[{"name":"uris","type":"array","values":["ގc�v\u000fm�\u0010 U��`Վ�b��UeV�\u00175�L�ɇ?�#��N�{A�\\�\u0007�(\u001b[]!qB/\f\u0012r��|�0+`(�$�U��}�1n��o�T�A.�Р!�s�\u001f\\'��\b']\u0014l��\u0005�; DxU�Ñ\b�\u0002Uq��ˌ*�4\"\u001d��\u0014�Tل��6��k�>z�n��Y��\u0004��k\u0007�/��\u0010:m'#��9��(Uu��N�D��\u0000J��\u0013�\u0017$L�׾T�v(\u001ec{�\b9�)ȡ�d!~��\u0007�m%�Tc�\u000b9��i�� 0X�Hvk�E\u0005�(6K�9w�\u001c�A\f#7d\u001fw�F�EQ�\u001f��*eW��\f��z�6;�ご��'h�bD^�_H?$?�\u0015\u0011��9}4��\u0018��\u0016\u0002��,h\u0005�]��M\u0004�\u0001�\u0001�L�o�+�\u0002]��D\t��7Fݰ\u0014Ùe�\u0004N�׺��9OУ?,erŦ�u}N\u0003\u0004�J�v�%ܚ�.�ܣV2�{H�I��#�\u000b��\\GjKʴ��\u0002Fl��%�\u0018}�|Nv2a\u0005��9/\u0015w�l�S��T��)�#��c\u001bD�C5��\t\u0018�;hYGq��\u0014��\u0011ZJ��}.L߼ڨ"]},{"name":"encrypted","type":"bool","values":[true]},{"name":"version","type":"str","values":["1.5"]},{"name":"page_count","type":"int","values":[1]}]}]},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":["opensource","commodity","meterpreter","modular"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":43},"sandbox_signatures":{"informative_count":82,"suspicious_count":3,"malicious_count":2,"total":87},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Tries to GET non-existent files from a web server"},{"type":"malicious","value":"GETs files from a web server (Office documents)"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Stealth","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"\"C:\\ExternalDisbursementDiscrepancies_CRPS_110420261ExceptionItem_s_onFercBatchEntry-PossibleReturnon11062026_STMT_FERC212359033529337997255.pdf\"\" (Indicator: \"RC2\"; File: \"AcroRd32.exe\")\n Found reference to \"Windows.Security.Cryptography.Core.HashAlgorithmNames\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00004924.00000000.204769.87E77000.00000004.mdmp, 00000000-00004924.00000001.205324.87E77000.00000004.mdmp\")\n Found reference to \"Windows.Security.Cryptography.Core.HashAlgorithmProviderer\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00004924.00000000.204769.87E77000.00000004.mdmp, 00000000-00004924.00000001.205324.87E77000.00000004.mdmp\")\n Found reference to \"Windows.Security.Cryptography.Core.HashAlgorithmProvider\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00004924.00000000.204769.87E77000.00000004.mdmp, 00000000-00004924.00000001.205324.87E77000.00000004.mdmp\")\n Found reference to \"RC2V\" (Indicator: \"RC2\"; Source: \"00000000-00004924.00000000.204769.8AFC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - PE_NAME=\\\\.\\pi; Source: \"00000000-00004924.00000000.204769.87F00000.00000004.mdmp, 00000000-00004924.00000001.205324.87F00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at EE050000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"AcroRd32.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"msedge.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$36","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"identity_helper.exe\" queried SystemProcessInformation at 00000000-00004924-00000C15-1624987769 [PID: 4924]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00004924-00000C15-1624996340 [PID: 4924]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"AcroRd32.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Adobe\\Acrobat\\11.0\\AdobeFnt14.lst.3848\" to \"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeSysFnt11.lst\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"fromCharCodeU\" (Indicator: \"fromcharcode\"; Source: \"00000000-00004924.00000000.204769.8ADD0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.94336","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to decrypt/decode data\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"postMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00004924.00000000.204769.8ADD0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"identity_helper.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004924)\n \"identity_helper.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004924)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"AcroRd32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003848)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"identity_helper.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004924)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$37","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"identity_helper.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"identity_helper.exe\" queried token user identity (UID: 00000000-00004924)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA STREAM ESTABLISHED invalid ack\" (SID: 2210029, Rev: 3, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM Packet with invalid ack\" (SID: 2210045, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM ESTABLISHED packet out of window\" (SID: 2210020, Rev: 3, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM bad window update\" (SID: 2210056, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM FIN invalid ack\" (SID: 2210030, Rev: 3, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM FIN out of window\" (SID: 2210038, Rev: 3, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM SHUTDOWN RST invalid ack\" (SID: 2210046, Rev: 3, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/24 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Additional Submission Context","description":"$38","origin":"File/Memory","relevance":10,"id":"string-42","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"prod-streaming-video-msn-com.akamaized.net\"\n \"services.bingapis.com\"\n \"www.baltimoreravens.com\"\n \"www.digitalcommerce360.com\"\n \"www.budgetseniors.com\"\n \"www.napa-net.org\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"99.84.160.10:443\"\n \"150.171.73.13:443\"\n \"151.101.1.55:443\"\n \"172.67.213.231:443\"\n \"141.193.213.11:443\"\n \"23.56.109.209:443\"\n \"172.67.213.231\"\n \"142.251.214.33:443\"\n \"104.18.40.59:443\"\n \"35.190.80.1:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3c","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"addressbook.acrodata\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"YouTube\" (Indicator: \"youtube\"; File: \"screen_10.png\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - EDGE_CRASHPAD_PIPE_NAME=\\\\.\\pipe\\crashpad_7468_YVHUQROWFJVYYKPA","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3d","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"msedge.exe\" (UID: 00000000-00007468)\n Launches browser \"msedge.exe\" (UID: 00000000-00007920)\n Launches browser \"msedge.exe\" (UID: 00000000-00002920)\n Launches browser \"msedge.exe\" (UID: 00000000-00003200)\n Launches browser \"msedge.exe\" (UID: 00000000-00004248)\n Launches browser \"msedge.exe\" (UID: 00000000-00005280)\n Launches browser \"msedge.exe\" (UID: 00000000-00002236)\n Launches browser \"msedge.exe\" (UID: 00000000-00003988)\n Launches browser \"msedge.exe\" (UID: 00000000-00002976)\n Launches browser \"msedge.exe\" (UID: 00000000-00001072)\n Launches browser \"msedge.exe\" (UID: 00000000-00004396)\n Launches browser \"msedge.exe\" (UID: 00000000-00004408)\n Launches browser \"msedge.exe\" (UID: 00000000-00000740)\n Launches browser \"msedge.exe\" (UID: 00000000-00002888)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at F9C30000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at F9DC0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FA9F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a3b1f9fb7f0000@ntdll.dll\"\n \"220023000000000038a3b1f9fb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"External Disbursement Discrepancies (CRPS) 11042026 1 Exception Item(s) on Ferc Batch Entry - Possible Return on 11062026_STMT_FERC212359033529337997255.pdf\" was detected as \"PDF\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"identity_helper.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"identity_helper.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\\TREATAS\")\n \"identity_helper.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")\n \"identity_helper.exe\" touched \"Property System Apartment Class Factory\" (Path: \"HKCU\\CLSID\\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}\\TREATAS\")\n \"identity_helper.exe\" touched \"ShellItem Shell Namespace helper\" (Path: \"HKCU\\CLSID\\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\\TREATAS\")\n \"identity_helper.exe\" touched \"Windows Search Manager\" (Path: \"HKCU\\CLSID\\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\\TREATAS\")\n \"identity_helper.exe\" touched \"Windows Push Notification Developer Proxy Stub\" (Path: \"HKCU\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"clients2.googleusercontent.com\"\n \"edge-consumer-static.azureedge.net\"\n \"prod-streaming-video-msn-com.akamaized.net\"\n \"r.msftstatic.com\"\n \"sb.scorecardresearch.com\"\n \"services.bingapis.com\"\n \"www.baltimoreravens.com\"\n \"www.budgetseniors.com\"\n \"www.digitalcommerce360.com\"\n \"www.napa-net.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$40","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$41","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$42","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a web server","description":"$43","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"identity_helper.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$44","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"A9Roq6zof_mxe80n_2yw.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Roq6zof_mxe80n_2yw.tmp]\n \"A9Rk8fm0l_mxe80p_2yw.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rk8fm0l_mxe80p_2yw.tmp]\n \"FAP4594.tmp\" has type \"ASCII text with no line terminators\" - Location: [%TEMP%\\FAP4594.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"identity_helper.exe\" queries basic process information of the \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe\" (UID: 4924)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"identity_helper.exe\" trying to touch file \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge_elf.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\msedge_elf.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\dbghelp.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\dbghelp.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\Windows\\System32\\dbghelp.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\dbghelp.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\WINMM.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\WINMM.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\Windows\\System32\\winmm.dll\"\n \"identity_helper.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\WINMM.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"identity_helper.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\LocalState\\ToastCollectionIcons\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssi.dat\"\n \"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annss.dat\"\n \"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssk.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"$48","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"mx._\" [Source: 00000000-00004924.00000000.204769.8AFC0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"\n \"14.5.40.5\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4a","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$4b","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"services.bingapis.com\" has high entropy\n Contacted domain: \"www.baltimoreravens.com\" has high entropy\n Contacted domain: \"www.digitalcommerce360.com\" has high entropy\n Contacted domain: \"www.budgetseniors.com\" has high entropy\n Contacted domain: \"clients2.googleusercontent.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"r.msftstatic.com\" (9 days old)\n Newly renewed or created SSL certificate: \"www.baltimoreravens.com\" (6 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$4c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"clients2.googleusercontent.com\" (83 days old)\n Short term registered certificate: \"www.baltimoreravens.com\" (89 days old)\n Short term registered certificate: \"www.budgetseniors.com\" (90 days old)\n Short term registered certificate: \"www.digitalcommerce360.com\" (89 days old)\n Short term registered certificate: \"www.napa-net.org\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"99.84.160.10\" on port \"443\"\n HTTPS traffic to \"150.171.73.13\" on port \"443\"\n HTTPS traffic to \"151.101.1.55\" on port \"443\"\n HTTPS traffic to \"172.67.213.231\" on port \"443\"\n HTTPS traffic to \"141.193.213.11\" on port \"443\"\n HTTPS traffic to \"23.56.109.209\" on port \"443\"\n HTTPS traffic to \"142.251.214.33\" on port \"443\"\n HTTPS traffic to \"104.18.40.59\" on port \"443\"\n HTTPS traffic to \"35.190.80.1\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--profile-directory=Default\" (Indicator: \"--profile-directory=\"; File: \"msedge.exe\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"AcroRd32.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 74B80000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"identity_helper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"identity_helper.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password_manager.mojom.CSVPasswordParser\" (Indicator: \"password\"; Source: \"00000000-00004924.00000000.204769.00004000.00000004.mdmp\")\n Found string \"passwords\" (Indicator: \"password\"; Source: \"00000000-00004924.00000000.204769.0006C000.00000004.mdmp, 00000000-00004924.00000001.205324.0006C000.00000004.mdmp, 00000000-00004924.00000001.205324.D1801000.00000002.mdmp, 00000000-00004924.00000001.205324.E9070000.00000002.mdmp\")\n Found string \"password_manager\" (Indicator: \"password\"; Source: \"00000000-00004924.00000000.204769.0006C000.00000004.mdmp, 00000000-00004924.00000001.205324.0006C000.00000004.mdmp, 00000000-00004924.00000001.205324.D1801000.00000002.mdmp, 00000000-00004924.00000001.205324.E9070000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004924.00000000.204769.0006C000.00000004.mdmp\n 00000000-00004924.00000001.205324.0006C000.00000004.mdmp\n 00000000-00004924.00000001.205324.D1801000.00000002.mdmp\n 00000000-00004924.00000001.205324.E9070000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"msedge.exe\" opened \"\\Device\\KsecDD\"\n \"identity_helper.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00004924.00000000.204769.87EB7000.00000004.mdmp, 00000000-00004924.00000001.205324.87EB7000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$4f","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 172.67.213.231\"\n \"UDP connection to 141.193.213.11\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"$50","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"malicious","category":"General","name":"GETs files from a web server (Office documents)","description":"$51","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-16","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Document analysis contacts a domain","description":"Often seen on documents with macro droppers\n embedded files or exploits","origin":"Indicator Combinations","relevance":3,"id":"summary-1","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 10 domains and 10 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]}],"intel_graph":{"map":{"Domain:clients2.googleusercontent.com":{"type":"Domain","value":"clients2.googleusercontent.com"},"Domain:edge-consumer-static.azureedge.net":{"type":"Domain","value":"edge-consumer-static.azureedge.net"},"Domain:prod-streaming-video-msn-com.akamaized.net":{"type":"Domain","value":"prod-streaming-video-msn-com.akamaized.net"},"Domain:r.msftstatic.com":{"type":"Domain","value":"r.msftstatic.com"},"Domain:sb.scorecardresearch.com":{"type":"Domain","value":"sb.scorecardresearch.com"},"Domain:services.bingapis.com":{"type":"Domain","value":"services.bingapis.com"},"Domain:www.baltimoreravens.com":{"type":"Domain","value":"www.baltimoreravens.com"},"Domain:www.budgetseniors.com":{"type":"Domain","value":"www.budgetseniors.com"},"Domain:www.digitalcommerce360.com":{"type":"Domain","value":"www.digitalcommerce360.com"},"Domain:www.napa-net.org":{"type":"Domain","value":"www.napa-net.org"},"File:006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1":{"type":"File","value":"006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1"},"File:1c63cec0560b428b22b55edb89f287814a423d63efa81170255620355995ddf0":{"type":"File","value":"1c63cec0560b428b22b55edb89f287814a423d63efa81170255620355995ddf0"},"File:3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60":{"type":"File","value":"3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60"},"File:331fc190c902df764f355f45894e15f4748d6bf716c0ec63792d223897620be5":{"type":"File","value":"331fc190c902df764f355f45894e15f4748d6bf716c0ec63792d223897620be5"},"File:4bed2f3577b8b76dddaf1533dc7625a5f8353b24adfc779b5c7b3eae31d2d97e":{"type":"File","value":"4bed2f3577b8b76dddaf1533dc7625a5f8353b24adfc779b5c7b3eae31d2d97e"},"File:5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68":{"type":"File","value":"5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68"},"File:5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975":{"type":"File","value":"5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975"},"File:679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e":{"type":"File","value":"679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e"},"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee":{"type":"File","value":"964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee"},"File:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08":{"type":"File","value":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"},"File:d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3":{"type":"File","value":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3"},"File:f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71":{"type":"File","value":"f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71"},"File:fe8146a53fa4377e62d7688c9db02a3dc0277540aee3810dd2c18947a765bf02":{"type":"File","value":"fe8146a53fa4377e62d7688c9db02a3dc0277540aee3810dd2c18947a765bf02"},"Ip:104.18.40.59":{"type":"Ip","value":"104.18.40.59"},"Ip:141.193.213.11":{"type":"Ip","value":"141.193.213.11"},"Ip:142.251.214.33":{"type":"Ip","value":"142.251.214.33"},"Ip:150.171.110.7":{"type":"Ip","value":"150.171.110.7"},"Ip:150.171.27.10":{"type":"Ip","value":"150.171.27.10"},"Ip:150.171.73.13":{"type":"Ip","value":"150.171.73.13"},"Ip:151.101.1.55":{"type":"Ip","value":"151.101.1.55"},"Ip:172.67.213.231":{"type":"Ip","value":"172.67.213.231"},"Ip:23.56.109.209":{"type":"Ip","value":"23.56.109.209"},"Ip:35.190.80.1":{"type":"Ip","value":"35.190.80.1"},"Ip:99.84.160.10":{"type":"Ip","value":"99.84.160.10"},"Url:/":{"type":"Url","value":"/"},"Url:/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t":{"type":"Url","value":"/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"},"Url:/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=citybiz.co?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t":{"type":"Url","value":"/favicon?url=citybiz.co?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"},"Url:/favicon?url=cybernews.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t":{"type":"Url","value":"/favicon?url=cybernews.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"},"Url:/favicon?url=drugstorenews.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=drugstorenews.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=exclaim.ca?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=exclaim.ca?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=global-benefits-vision.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t":{"type":"Url","value":"/favicon?url=global-benefits-vision.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"},"Url:/favicon?url=jaguars.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=jaguars.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=kvom.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=kvom.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=pressboxonline.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=pressboxonline.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=pulse2.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t":{"type":"Url","value":"/favicon?url=pulse2.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"},"Url:/favicon?url=rollingstonesdata.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=rollingstonesdata.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/v1/eus007/8555bc88-d2ea-4f65-86d4-5cd980a64507/8927a1c0-bb80-4c98-a79b-e7c7ef7435f0_2250.mp4":{"type":"Url","value":"/v1/eus007/8555bc88-d2ea-4f65-86d4-5cd980a64507/8927a1c0-bb80-4c98-a79b-e7c7ef7435f0_2250.mp4"},"Url:/v1/eus012/de932785-1c72-4fda-bb2f-bcdb570097b0/9823596c-1fc7-4c03-b824-ecfb02a17012_2250.mp4":{"type":"Url","value":"/v1/eus012/de932785-1c72-4fda-bb2f-bcdb570097b0/9823596c-1fc7-4c03-b824-ecfb02a17012_2250.mp4"}},"chains":[{"id":"sandbox_network","root":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","edges":[{"edge_kind":"contacted_ip","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Ip:99.84.160.10"},{"edge_kind":"contacted_ip","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Ip:150.171.73.13"},{"edge_kind":"contacted_ip","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Ip:151.101.1.55"},{"edge_kind":"contacted_ip","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Ip:172.67.213.231"},{"edge_kind":"contacted_ip","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Ip:141.193.213.11"},{"edge_kind":"contacted_ip","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Ip:23.56.109.209"},{"edge_kind":"contacted_ip","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Ip:172.67.213.231"},{"edge_kind":"contacted_ip","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Ip:142.251.214.33"},{"edge_kind":"contacted_ip","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Ip:104.18.40.59"},{"edge_kind":"contacted_ip","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Ip:35.190.80.1"},{"edge_kind":"contacted_domain","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Domain:clients2.googleusercontent.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.googleusercontent.com","to_key":"Ip:142.251.214.33"},{"edge_kind":"contacted_domain","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Domain:edge-consumer-static.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edge-consumer-static.azureedge.net","to_key":"Ip:150.171.110.7"},{"edge_kind":"contacted_domain","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Domain:prod-streaming-video-msn-com.akamaized.net"},{"edge_kind":"resolves_to","from_key":"Domain:prod-streaming-video-msn-com.akamaized.net","to_key":"Ip:23.56.109.209"},{"edge_kind":"contacted_domain","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Domain:r.msftstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:r.msftstatic.com","to_key":"Ip:150.171.27.10"},{"edge_kind":"contacted_domain","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Domain:sb.scorecardresearch.com"},{"edge_kind":"resolves_to","from_key":"Domain:sb.scorecardresearch.com","to_key":"Ip:99.84.160.10"},{"edge_kind":"contacted_domain","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Domain:services.bingapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:services.bingapis.com","to_key":"Ip:150.171.73.13"},{"edge_kind":"contacted_domain","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Domain:www.baltimoreravens.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.baltimoreravens.com","to_key":"Ip:151.101.1.55"},{"edge_kind":"contacted_domain","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Domain:www.budgetseniors.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.budgetseniors.com","to_key":"Ip:172.67.213.231"},{"edge_kind":"contacted_domain","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Domain:www.digitalcommerce360.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.digitalcommerce360.com","to_key":"Ip:141.193.213.11"},{"edge_kind":"contacted_domain","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Domain:www.napa-net.org"},{"edge_kind":"resolves_to","from_key":"Domain:www.napa-net.org","to_key":"Ip:104.18.40.59"},{"edge_kind":"contacted_url","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Url:/v1/eus007/8555bc88-d2ea-4f65-86d4-5cd980a64507/8927a1c0-bb80-4c98-a79b-e7c7ef7435f0_2250.mp4"},{"edge_kind":"contacted_url","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Url:/v1/eus012/de932785-1c72-4fda-bb2f-bcdb570097b0/9823596c-1fc7-4c03-b824-ecfb02a17012_2250.mp4"},{"edge_kind":"contacted_url","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Url:/favicon?url=exclaim.ca?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Url:/favicon?url=rollingstonesdata.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Url:/favicon?url=jaguars.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Url:/favicon?url=pressboxonline.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Url:/favicon?url=kvom.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Url:/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Url:/"},{"edge_kind":"contacted_url","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Url:/favicon?url=drugstorenews.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Url:/favicon?url=cybernews.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"},{"edge_kind":"contacted_url","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Url:/favicon?url=pulse2.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"},{"edge_kind":"contacted_url","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Url:/favicon?url=citybiz.co?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"},{"edge_kind":"contacted_url","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Url:/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"},{"edge_kind":"contacted_url","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"Url:/favicon?url=global-benefits-vision.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","edges":[{"edge_kind":"extracted","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"File:679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e"},{"edge_kind":"extracted","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"File:331fc190c902df764f355f45894e15f4748d6bf716c0ec63792d223897620be5"},{"edge_kind":"extracted","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"File:1c63cec0560b428b22b55edb89f287814a423d63efa81170255620355995ddf0"},{"edge_kind":"extracted","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"File:fe8146a53fa4377e62d7688c9db02a3dc0277540aee3810dd2c18947a765bf02"},{"edge_kind":"extracted","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"File:d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3"},{"edge_kind":"extracted","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"File:f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71"},{"edge_kind":"extracted","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"File:5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68"},{"edge_kind":"extracted","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"File:006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1"},{"edge_kind":"extracted","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"File:3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60"},{"edge_kind":"extracted","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"File:5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975"},{"edge_kind":"extracted","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"File:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"},{"edge_kind":"extracted","from_key":"File:964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee","to_key":"File:4bed2f3577b8b76dddaf1533dc7625a5f8353b24adfc779b5c7b3eae31d2d97e"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":17,"spawned_processes_count":17,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":80,"imported_dlls_count":237,"dropped_files_count":0,"extracted_files_count":12,"files_written_count":34,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":10,"dns_resolutions_count":10,"contacted_urls_count":15,"http_requests_count":15},"behavior_tags":["opensource","commodity","meterpreter","modular"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6aed0746c249d9f42200a299","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"contacted_countries":["SWE","USA"],"submit_name":"External Disbursement Discrepancies (CRPS) 11042026 1 Exception Item(s) on Ferc Batch Entry - Possible Return on 11062026_STMT_FERC212359033529337997255.pdf","analysis_start_time":"2026-11-05T22:46:31+00:00","indicators_count":{"informative":82,"suspicious":7,"malicious":2},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"99.84.160.10","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"address":"150.171.73.13","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"address":"151.101.1.55","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"address":"172.67.213.231","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"address":"141.193.213.11","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"address":"23.56.109.209","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"address":"172.67.213.231","port":0,"protocol":"ICMP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"address":"142.251.214.33","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"address":"104.18.40.59","port":443,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"address":"35.190.80.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]}],"dns_resolutions":[{"domain":"clients2.googleusercontent.com","address":"142.251.214.33","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"domain":"edge-consumer-static.azureedge.net","address":"150.171.110.7","ttl":854,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"domain":"prod-streaming-video-msn-com.akamaized.net","address":"23.56.109.209","ttl":12519,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"domain":"r.msftstatic.com","address":"150.171.27.10","ttl":560,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"domain":"sb.scorecardresearch.com","address":"99.84.160.10","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"domain":"services.bingapis.com","address":"150.171.73.13","ttl":2540,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"domain":"www.baltimoreravens.com","address":"151.101.1.55","ttl":2743,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"domain":"www.budgetseniors.com","address":"172.67.213.231","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"domain":"www.digitalcommerce360.com","address":"141.193.213.11","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"domain":"www.napa-net.org","address":"104.18.40.59","ttl":60,"country":"Sweden","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]}],"http_requests":[{"host":"prod-streaming-video-msn-com.akamaized.net","host_ip":"23.56.109.209:443","url":"/v1/eus007/8555bc88-d2ea-4f65-86d4-5cd980a64507/8927a1c0-bb80-4c98-a79b-e7c7ef7435f0_2250.mp4","method":"GET","response_code":"206","response_phrase":"Partial Content","header":"GET /v1/eus007/8555bc88-d2ea-4f65-86d4-5cd980a64507/8927a1c0-bb80-4c98-a79b-e7c7ef7435f0_2250.mp4 HTTP/1.1\nHost: prod-streaming-video-msn-com.akamaized.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nAccept-Encoding: identity;q=1, *;q=0\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: cross-site\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: video\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nAccept-Language: en-US,en;q=0.9\nRange: bytes=7536640-7589925\nIf-Range: \"0x8DEE634904B5DFC\"","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"host":"prod-streaming-video-msn-com.akamaized.net","host_ip":"23.56.109.209:443","url":"/v1/eus012/de932785-1c72-4fda-bb2f-bcdb570097b0/9823596c-1fc7-4c03-b824-ecfb02a17012_2250.mp4","method":"GET","response_code":"206","response_phrase":"Partial Content","header":"GET /v1/eus012/de932785-1c72-4fda-bb2f-bcdb570097b0/9823596c-1fc7-4c03-b824-ecfb02a17012_2250.mp4 HTTP/1.1\nHost: prod-streaming-video-msn-com.akamaized.net\nConnection: keep-alive\nsec-ch-ua-platform: \"Windows\"\nAccept-Encoding: identity;q=1, *;q=0\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nsec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nsec-ch-ua-mobile: ?0\nAccept: */*\nSec-Fetch-Site: cross-site\nSec-Fetch-Mode: no-cors\nSec-Fetch-Dest: video\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nAccept-Language: en-US,en;q=0.9\nRange: bytes=8945664-8975272\nIf-Range: \"0x8DF11883AA9FFF8\"","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=exclaim.ca?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=exclaim.ca?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=rollingstonesdata.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=rollingstonesdata.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=jaguars.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=jaguars.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=pressboxonline.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=pressboxonline.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=kvom.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=kvom.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"host":"www.baltimoreravens.com","host_ip":"151.101.1.55:443","url":"/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: www.baltimoreravens.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"host":"www.budgetseniors.com","host_ip":"172.67.213.231:443","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/2\nHost: www.budgetseniors.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=drugstorenews.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=drugstorenews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=cybernews.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=cybernews.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=pulse2.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=pulse2.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=citybiz.co?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=citybiz.co?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"host":"www.napa-net.org","host_ip":"104.18.40.59:443","url":"/favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /favicon.ico?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2\nHost: www.napa-net.org\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=global-benefits-vision.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=global-benefits-vision.com?w=16&h=16&q=100&m=6&f=webp&u=t?w=32&h=32&q=100&m=6&f=png&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}],"processes":[{"pid":3848,"ppid":0,"name":"AcroRd32.exe","command_line":"\"C:\\ExternalDisbursementDiscrepancies_CRPS_110420261ExceptionItem_s_onFercBatchEntry-PossibleReturnon11062026_STMT_FERC212359033529337997255.pdf\"","sha256":"c43c0929e1f9b27dac07d49b0a659e83be4cdb4dfdd709eb7e37a341cd169e87","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","uid":"00000000-00003848","icon":"$52"},{"pid":7468,"ppid":0,"name":"msedge.exe","command_line":"--profile-directory=Default","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00007468","icon":"$53"},{"pid":7920,"ppid":7468,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ffbd18f0f18,0x7ffbd18f0f24,0x7ffbd18f0f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007468","uid":"00000000-00007920"},{"pid":2920,"ppid":7468,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1816,i,5327649900767340669,13121622077190595706,262144 --field-trial-handle=2968,i,17500076041966269525,164978742258909119,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2904 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007468","uid":"00000000-00002920"},{"pid":3200,"ppid":7468,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1884,i,1927836247080884541,4402783529632636945,524288 --field-trial-handle=2968,i,17500076041966269525,164978742258909119,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=3068 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007468","uid":"00000000-00003200"},{"pid":4248,"ppid":7468,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2196,i,13116916176531932262,15741480176076002001,524288 --field-trial-handle=2968,i,17500076041966269525,164978742258909119,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3544 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007468","uid":"00000000-00004248"},{"pid":5280,"ppid":7468,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1793915784897078 --launch-time-ticks=3147610222 --skip-read-main-dll --metrics-shmem-handle=3268,i,6285964524122113424,13888469262346118231,2097152 --field-trial-handle=2968,i,17500076041966269525,164978742258909119,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3600 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007468","uid":"00000000-00005280"},{"pid":2236,"ppid":7468,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1793915784897078 --launch-time-ticks=3147603934 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3232,i,10701208021360652617,13511798050963705309,2097152 --field-trial-handle=2968,i,17500076041966269525,164978742258909119,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3596 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007468","uid":"00000000-00002236"},{"pid":3988,"ppid":7468,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --skip-read-main-dll --metrics-shmem-handle=5488,i,8359879559703757984,1030924091472427782,524288 --field-trial-handle=2968,i,17500076041966269525,164978742258909119,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5116 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007468","uid":"00000000-00003988"},{"pid":2976,"ppid":7468,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5668,i,11366489965224204980,16418378267487222651,524288 --field-trial-handle=2968,i,17500076041966269525,164978742258909119,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5676 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007468","uid":"00000000-00002976"},{"pid":1072,"ppid":7468,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=2852,i,13741002552585308071,5475439381896649172,524288 --field-trial-handle=2968,i,17500076041966269525,164978742258909119,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5736 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007468","uid":"00000000-00001072"},{"pid":4396,"ppid":7468,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=2732,i,10124305783740254411,102658483071175981,524288 --field-trial-handle=2968,i,17500076041966269525,164978742258909119,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=2912 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007468","uid":"00000000-00004396"},{"pid":4944,"ppid":7468,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6676,i,14880625426773103482,15516652254942010246,524288 --field-trial-handle=2968,i,17500076041966269525,164978742258909119,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6692 /prefetch:8","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00007468","uid":"00000000-00004944"},{"pid":4408,"ppid":7468,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=5456,i,9316081715659672813,9667168934815619760,524288 --field-trial-handle=2968,i,17500076041966269525,164978742258909119,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5436 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007468","uid":"00000000-00004408"},{"pid":740,"ppid":7468,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=6924,i,13929334254660342274,6497191911532744620,524288 --field-trial-handle=2968,i,17500076041966269525,164978742258909119,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5368 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007468","uid":"00000000-00000740"},{"pid":4924,"ppid":7468,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6676,i,14880625426773103482,15516652254942010246,524288 --field-trial-handle=2968,i,17500076041966269525,164978742258909119,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6692 /prefetch:8","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00007468","uid":"00000000-00004924"},{"pid":2888,"ppid":7468,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5456,i,1343499541064594594,5280565374634419244,524288 --field-trial-handle=2968,i,17500076041966269525,164978742258909119,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5440 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007468","uid":"00000000-00002888"}],"all_imported_dlls":["shell32.dll","ccme_base_non_fips.dll","ccme_ecdrbg.dll","OneCoreCommonProxyStub.dll","capauthz.dll","mfplat.dll","CapabilityAccessManagerClient.dll","netutils.dll","wtsapi32.dll","StructuredQuery.dll","KernelBase.dll","apphelp.dll","windows.storage.dll","Windows.Web.dll","StateRepository.Core.dll","TextShaping.dll","SensApi.dll","rasadhlp.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","ffmpeg.dll","wlanapi.dll","msacm32.dll","comctl32.dll","fwbase.dll","cryptsp.dll","Windows.Globalization.dll","dmcmnutils.dll","Windows.Internal.UI.Shell.WindowTabManager.dll","wldp.dll","msvcp100.dll","clbcatq.dll","shlwapi.dll","ccme_base.dll","msvcrt.dll","Windows.UI.dll","wintrust.dll","Windows.UI.Immersive.dll","LocationFrameworkPS.dll","vk_swiftshader.dll","ExecModelClient.dll","dwmapi.dll","AXE8SharedExpat.dll","winnsi.dll","libEGL.dll","AdobeXMP.dll","npmproxy.dll","AppXDeploymentClient.dll","imagehlp.dll","IPHLPAPI.DLL","mdmregistration.dll","Windows.ApplicationModel.dll","PCPKsp.dll","wevtapi.dll","ntdll.dll","usermgrcli.dll","mlang.dll","gpapi.dll","psapi.dll","slc.dll","Windows.Security.Authentication.Web.Core.dll","Windows.Storage.ApplicationData.dll","sspicli.dll","imm32.dll","DataExchange.dll","dpapi.dll","oneds.dll","domain_actions.dll","libGLESv2.dll","rpcrt4.dll","SHCore.dll","cryptbase.dll","secur32.dll","Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll","slwga.dll","wsock32.dll","cryptocme.dll","ShellCommonCommonProxyStub.dll","schannel.dll","d3d11.dll","propsys.dll","msedge.dll","ncrypt.dll","ucrtbase.dll","TextInputFramework.dll","MMDevAPI.dll","edputil.dll","samcli.dll","twinapi.appcore.dll","CryptoWinRT.dll","sechost.dll","policymanager.dll","Windows.Internal.Shell.Broker.dll","dnsapi.dll","winsta.dll","Windows.Networking.Connectivity.dll","AXSLE.dll","BCP47Langs.dll","OneCoreUAPCommonProxyStub.dll","Geolocation.dll","biwinrt.dll","wkscli.dll","telclient.dll","mf.dll","oneauth.dll","MicrosoftAccountWAMExtension.dll","vcruntime140_1.dll","wow64win.dll","kernel.appcore.dll","ws2_32.dll","GdiPlus.dll","ccme_asym.dll","dsreg.dll","Windows.Devices.Enumeration.dll","execmodelproxy.dll","ccme_ecc.dll","wpnapps.dll","DXCore.dll","UserMgrProxy.dll","iertutil.dll","atlthunk.dll","directmanipulation.dll","userenv.dll","CoreMessaging.dll","dusmapi.dll","kernel32.dll","coloradapterclient.dll","avrt.dll","d3dcompiler_47.dll","cfgmgr32.dll","oleacc.dll","webauthn.dll","Windows.Storage.Search.dll","combase.dll","winhttp.dll","WindowManagementAPI.dll","wininet.dll","mswsock.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","setupapi.dll","BIB.dll","OnDemandConnRouteHelper.dll","nsi.dll","ntasn1.dll","bcrypt.dll","srvcli.dll","profapi.dll","CoreUIComponents.dll","dsound.dll","advapi32.dll","powrprof.dll","DWrite.dll","Windows.StateRepositoryPS.dll","microsoft_shell_integration.dll","winmm.dll","AcroRd32.dll","ntmarta.dll","NPSWF32.dll","Windows.StateRepository.dll","BCP47mrm.dll","ksuser.dll","tbs.dll","version.dll","netprofm.dll","mscms.dll","msedge_elf.dll","omadmapi.dll","comdlg32.dll","uxtheme.dll","sqlite.dll","msftedit.dll","sppc.dll","ole32.dll","mpr.dll","dcomp.dll","well_known_domains.dll","ncryptprov.dll","msasn1.dll","VxSSL64.dll","wow64cpu.dll","netapi32.dll","umpdc.dll","SystemSettings.DataModel.dll","FirewallAPI.dll","BitsProxy.dll","wscapi.dll","wow64.dll","AGM.dll","globinputhost.dll","nlaapi.dll","dbghelp.dll","user32.dll","winmmbase.dll","InputHost.dll","msvcp110_win.dll","rmclient.dll","xmllite.dll","fltLib.dll","vaultcli.dll","onnxruntime.dll","StartTileData.dll","rsaenh.dll","WinTypes.dll","KBDUS.DLL","linkinfo.dll","sxs.dll","twinapi.dll","CoolType.dll","AssignedAccessRuntime.dll","Windows.System.Profile.RetailInfo.dll","RTWorkQ.dll","msvcp140.dll","AcGenral.dll","bcryptprimitives.dll","Windows.StateRepositoryCore.dll","vcruntime140.dll","d3d10warp.dll","win32u.dll","gdi32full.dll","msvcp_win.dll","oleaut32.dll","ieframe.dll","dhcpcsvc6.dll","msvcr100.dll","crypt32.dll","ACE.dll","devobj.dll","aadWamExtension.dll","PCShellCommonProxyStub.dll","ResourcePolicyClient.dll","gdi32.dll","dhcpcsvc.dll","TenantRestrictionsPlugin.dll","urlmon.dll","msctf.dll","dxgi.dll","FWPUCLNT.DLL","TileDataRepository.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"addressbook.acrodata","sha256":"679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"Annss.dat","sha256":"331fc190c902df764f355f45894e15f4748d6bf716c0ec63792d223897620be5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"Annssi.dat","sha256":"1c63cec0560b428b22b55edb89f287814a423d63efa81170255620355995ddf0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"Annssk.dat","sha256":"fe8146a53fa4377e62d7688c9db02a3dc0277540aee3810dd2c18947a765bf02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl","sha256":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sha256":"f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl","sha256":"006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"A9Rk8fm0l_mxe80p_2yw.tmp","sha256":"3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"A9Roq6zof_mxe80n_2yw.tmp","sha256":"5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"FAP4594.tmp","sha256":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"AdobeFnt14.lst.3848","sha256":"4bed2f3577b8b76dddaf1533dc7625a5f8353b24adfc779b5c7b3eae31d2d97e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]}],"files_written":[{"path":"pipe\\GmdAslLogger","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"%TEMP%\\FAP4594.tmp","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages-journal","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeFnt14.lst.3848","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\UserCache.bin","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\crashpad_7468_YVHUQROWFJVYYKPA","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.7468.4928.4029212772985785427","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.7468.4928.5123447284603617429","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.7468.4928.17892240569141773592","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.7468.3908.16329657531549917940","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.7468.3908.5903324943047607162","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.7468.3908.12062425848665559463","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.7468.3908.3280936079376184425","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.7468.3908.11774952702023482062","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.7468.4928.5121591816422565785","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.7468.4928.7982720559427740382","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.7468.4928.2230168429017856512","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.7468.1132.9610271964461229086","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.7468.3908.13638790952748924553","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.7468.4928.8406276776351192459","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.7468.4928.11793887554649067583","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.7468.4928.1024226279432158894","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.5280.5728.4779344784536063390","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"pipe\\LOCAL\\mojo.2236.6708.11523254863274303671","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"key":"HKLMHKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\ADOBE\\","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3848:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3848:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3848:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DirectSound DllMain mutex (0x00000F08)","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SM0:3848:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"Local\\SM0:3848:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SM0:3848:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"DirectSound DllMain mutex (0x00000F08)","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCEOBHIAPAAAAA","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCEOBHIAPAAAAA","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7468:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SM0:7468:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SmartScreenRemoteDatacustomSettings89d47eac7d371e27ad1c015a51345530","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SmartScreenRemoteDataedgeSettings89d47eac7d371e27ad1c015a51345530","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"Local\\SM0:7468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SmartScreenRemoteDatatopTraffic89d47eac7d371e27ad1c015a51345530","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SmartScreenLocalDatauriCache81451acec151ac953ae7f58ed54c5dd3","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SM0:7468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"Local\\SM0:7468:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SmartScreenRemoteDatawarnStateCache81451acec151ac953ae7f58ed54c5dd3","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SmartScreenRemoteDatacustomSynchronousLookupUris89d47eac7d371e27ad1c015a51345530","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SmartScreenLocalDatadownloadCache81451acec151ac953ae7f58ed54c5dd3","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SmartScreenRemoteDatacustomSettings89d47eac7d371e27ad1c015a51345530","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SmartScreenRemoteDataedgeSettings89d47eac7d371e27ad1c015a51345530","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SmartScreenRemoteDatacustomSynchronousLookupUris89d47eac7d371e27ad1c015a51345530","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SmartScreenRemoteDatatopTraffic89d47eac7d371e27ad1c015a51345530","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SmartScreenLocalDatadownloadCache81451acec151ac953ae7f58ed54c5dd3","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SmartScreenLocalDatauriCache81451acec151ac953ae7f58ed54c5dd3","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SmartScreenRemoteDatawarnStateCache81451acec151ac953ae7f58ed54c5dd3","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7468:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SM0:7920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"Local\\SM0:7920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"Local\\SM0:2920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3200:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SM0:3200:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"Local\\SM0:3200:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3200:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SM0:4248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\AppContainerNamedObjects\\S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-924012159-129201922\\SM0:5280:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\AppContainerNamedObjects\\S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-924012159-129201922\\SM0:2236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2976:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2976:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"Local\\SM0:2976:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SM0:2976:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4408:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SM0:4408:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SM0:740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4924:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"Local\\SM0:4924:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"Local\\SM0:4924:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SM0:4924:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SM0:4924:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4924:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4924:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4924:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2888:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SM0:2888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"Local\\SM0:2888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]},{"name":"SM0:2888:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0746c249d9f42200a299"}]}]}},"report_ids":{"sandbox_job_ids":["6aed0746c249d9f42200a299"]}}}]]}] 2c:[["$","title","0",{"children":"Suspicious Sample 964005e54ecd… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 964005e54ecd…. Threat score 35/100. 0/25 AV engines flagged this file. 2 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 964005e54ecd… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 964005e54ecd…. Threat score 35/100. 0/25 AV engines flagged this file. 2 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/964005e54ecd1ae9a2949b16b19ec8ec43cfe77068d19738884d829ef51db2ee"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 964005e54ecd… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 964005e54ecd…. Threat score 35/100. 0/25 AV engines flagged this file. 2 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L54","11",{}]] 32:null