24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T46f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Bottles Sample be29c4138754… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample be29c4138754…. Malware family: Bottles. Threat score 100/100. 14/25 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","keywords":["Malicious","Bottles","malware analysis","sandbox report","threat intelligence","be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f"],"about":{"@type":"SoftwareApplication","name":"windows_i386.exe","applicationCategory":["peexe","executable"],"identifier":"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Bottles","antivirusDetections":{"malicious":14,"total":25},"behavioralIndicators":{"malicious":3,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T560,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.0F000000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.0F000000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.0F000000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.0F000000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp")26:T804,"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" queried SystemProcessInformation at 00000000-00008172-00000C15-3093977129 [PID: 8172] "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" queried SystemProcessInformation at 00000000-00008172-00000C15-3093985787 [PID: 8172] "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" queried SystemProcessInformation at 00000000-00008172-00000C15-3094146445 [PID: 8172] "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" queried SystemProcessInformation at 00000000-00008172-00000C15-3094155598 [PID: 8172] "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" queried SystemProcessInformation at 00000000-00008172-00000C15-3094272065 [PID: 8172] "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" queried SystemProcessInformation at 00000000-00008172-00000C15-3094279990 [PID: 8172] "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" queried SystemProcessInformation at 00000000-00008172-00000C15-3102598089 [PID: 8172] "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" queried SystemProcessInformation at 00000000-00008172-00000C15-3102606653 [PID: 8172] "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" queried SystemProcessInformation at 00000000-00008172-00000C15-3102784381 [PID: 8172] "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" queried SystemProcessInformation at 00000000-00008172-00000C15-3102793801 [PID: 8172] "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" queried SystemProcessInformation at 00000000-00008172-00000C15-3103302049 [PID: 8172] "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" queried SystemProcessInformation at 00000000-00008172-00000C15-3103427426 [PID: 8172] "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" queried SystemProcessInformation at 00000000-00008172-00000C15-3103436351 [PID: 8172]27:T181f3,Contains base64 string in header "microsoftSsp" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "true" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gdpr" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "linkedin" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "1391f723" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "91e0" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "4064" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8cb8" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "08df8de6ce67" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Priority" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2Host: px.ads.linkedin.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "/sg/msn/1/cm" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "222166F75FD3671F181970045E3D66DC" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gdpr" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: trc.taboola.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: noneReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "222166F75FD3671F181970045E3D66DC" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gdpr" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "253A" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "252F" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "2526code" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "253D222166F75FD3671F181970045E3D66DC" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "2526gdpr" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "253D" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Shopping" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Flag" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "2Fmapuid" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "3Fmember" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "253A" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "252F" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "25252Fib" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "25252Fsetuid" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "25253Fentity" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Shopping" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Flag" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "/seg" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "2Fib" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "2Fsetuid" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "3Fentity" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Shopping" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Flag" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "222166F75FD3671F181970045E3D66DC" in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: ib.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gdpr" in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: ib.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: ib.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: ib.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: ib.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: ib.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: ib.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: ib.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: ib.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: ib.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: ib.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Shopping" in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: ib.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Flag" in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: ib.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: ib.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: ib.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2Host: ib.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image"28:T461,Found string "{"Id":0,"IsConnect":false,"VerifyKey":"","Tp":"tcp","Addr":"","Remark":"","Status":false,"LocalIP":"192.168.0.2","UserName":"" (Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp 00000000-00008172.00000002.266093.38480000.00000004.mdmp"), Found string "UserName"UserName":" (Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp 00000000-00008172.00000002.266093.38480000.00000004.mdmp"), Found string ""UserName":" (Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp 00000000-00008172.00000002.266093.38480000.00000004.mdmp"), Found string "{"Id":0 "IsConnect":false "VerifyKey":"" "Tp":"tcp" "Addr":"" "Remark":"" "Status":false "LocalIP":"192.168.0.2" "UserName":"wHqd58lSoiE00VH\\5oVGv68" "HostName":"wHqd58lSoiE00VH" "Location":"" "OsName":"windows_386" "ProcessName":"" (Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") file/memory contains long string(Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp")29:T411,Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00008172-00000C2C-3103163334") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00008172-00000C2C-3103163665") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00008172-00000C2C-3103163684") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00008172.00000000.262251.02B30000.00000004.mdmp, 00000000-00008172.00000001.264171.02B30000.00000004.mdmp, 00000000-00008172.00000002.266093.02B30000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp")2a:T80e,"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009e298f77080bb3020000000028000000240000000000b30208f25e000000000000000000000000000000000000000000d007810030000000000000000000000000008100000000007e0000000000000000000000e00ab30298b2b30200000000000000002000000000008100d0018100d40b810000000000d00b81000000000000f25e0050f58e77080bb30268f25e00b4f25e00 (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008172)2b:Tfd7,"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")2c:T892,"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00008172)2d:T7b12,"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetThreadLocale (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter IsBadReadPtr (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter __getmainargs (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter __initenv (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter __lconv_init (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter __p__acmdln (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter __p__fmode (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter __set_app_type (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter __setusermatherr (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter _amsg_exit (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter _beginthread (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter _cexit (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter _errno (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter _iob (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter _onexit (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter _stricmp (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter abort (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter exit (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter fprintf (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter memset (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter realloc (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter strlen (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter strtol (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter vfprintf (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter wcstombs (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter _exit (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter _lock (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter _snwprintf (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter _unlock (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter _vsnprintf (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter clock (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter fwprintf (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter isupper (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter raise (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter strcpy (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter time (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter wcscpy (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetWindowLongA (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter MapVirtualKeyA (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SendInput (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SetForegroundWindow (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter VkKeyScanA (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetSystemTimes (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter OpenClipboard (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter CloseClipboard (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter EmptyClipboard (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetClipboardData (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter SetClipboardData (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter NetGetJoinInformation (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter NetUserGetInfo (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter getsockname (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00008172) "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00008172)2e:T4765,Found reference to API (Indicator: "Sleep"; File: "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.0F000000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "getsockname"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "getpeername"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.0F000000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimes"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "NetUserGetInfo"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "closesocket"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "NetGetJoinInformation"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "GetAdaptersAddresses"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "CreateWaitableTimerExW"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "SetProcessPriorityBoost"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "MapVirtualKeyA"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp")2f:T8d9,Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2360:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2360:120:WilError_01" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2360:120:WilError_01" Process msedge.exe created mutex with name "Local\SM0:2360:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:2360:120:WilError_01" Process msedge.exe created mutex with name "ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "SM0:2360:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:2360:120:WilError_01" Process msedge.exe created mutex with name "Local\SessionImmersiveColorMutex" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2360:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7348:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\mfx_d3d_mutex" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7348:304:WilStaging_02" Process msedge.exe created mutex with name "mfx_d3d_mutex" Process msedge.exe created mutex with name "SM0:7348:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:7348:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4744:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4744:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:4744:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:4744:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7420:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7420:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:7420:304:WilStaging_02"30:T29cf,"GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67" Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Wed 30 Sep 2026 04:30:22 GMT Server: cloudflare X-Li-Fabric: prod-lva1 Cf-Ray: a4307df0acb71f2f-SJC Vary: Accept-Encoding X-Li-Proto: http/2 Content-Encoding: gzip Cf-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=31536000 Set-Cookie: __cf_bm=vfie9MiIaZOStbUdHAE1EiS.qdvdyBk2qOs.0gBE76w-1790742622.8291452-1.0.1.1-RWnyb_WSuayKDjxChXEY1IIBgEEVKRT3Jz2C6RgGaTkn6VzgReu8SBvHjv.7fMfvTrPJm1p7rVL6vNijVoRDbMolgL93vihWvXOABWk7pxzRxU7roM_NyxRrdPj1pTdR; HttpOnly; SameSite=None; Secure; Path=/; Domain=linkedin.com; Expires=Wed 30 Sep 2026 05:00:22 GMT X-Li-Uuid: AAZcq8HrvkTwgqVWnwVqaQ== Nel: {"report_to":"network-errors" "max_age":1296000 "success_fraction":0.00066 "failure_fraction":1 "include_subdomains":true} X-Content-Type-Options: nosniff X-Li-Pop: cf-prod-lva1-x Report-To: {"group":"network-errors" "max_age":2592000 "endpoints":[{"url":"https://www.linkedin.com/li/rep"}] "include_subdomains":true} Alt-Svc: h3=":443"; ma=86400 Linkedin-Action: 1 with response body ==>BINARY_CONTENT....... "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Date: Wed 30 Sep 2026 04:30:22 GMT Server: nginx X-Service-Version: v1 X-Served-By: cache-lax-kwhp1940054-LAX P3p: policyref="http://trc.taboola.com/p3p.xml" CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Pragma: no-cache X-Cache-Hits: 0 Via: 1.1 varnish Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-To-Nlb-Rtt: 43599 X-Timer: S1790742623.850914 VS0 VE46 X-Cache: MISS X-Vcl-Time-Ms: 46 Cache-Control: no-cache no-store Accept-Ranges: bytes with no response body "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 307 Temporary Redirect Content-Type: text/html; charset=utf-8 Date: Wed 30 Sep 2026 04:30:23 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=6525282700388545232; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue 29-Dec-2026 04:30:23 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: c1122e99-552f-4ccb-aa6e-ce55a771c994 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: uuid2=6525282700388545232 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 302 Found Content-Type: text/html; charset=utf-8 Date: Wed 30 Sep 2026 04:30:23 GMT Server: nginx/1.25.5 Expires: Sat 15 Nov 2008 16:00:00 GMT An-X-Request-Uuid: fd8e5e5b-da38-470e-85d2-b9f6e75b0b6f P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness Access-Control-Allow-Origin: * Set-Cookie: uuid2=6525282700388545232; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue 29-Dec-2026 04:30:23 GMT; Domain=.adnxs.com; Secure; HttpOnly Access-Control-Allow-Credentials: true X-Xss-Protection: 0 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D Cache-Control: no-store no-cache private with no response body "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-j Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 302 Found Content-Type: text/html; charset=utf-8 Date: Wed 30 Sep 2026 04:30:23 GMT Server: nginx/1.25.5 Expires: Sat 15 Nov 2008 16:00:00 GMT An-X-Request-Uuid: 9764a4ed-2409-4676-b352-1cc7ea145d0d P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness Access-Control-Allow-Origin: * Set-Cookie: uuid2=6525282700388545232; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue 29-Dec-2026 04:30:23 GMT; Domain=.adnxs.com; Secure; HttpOnly Access-Control-Allow-Credentials: true X-Xss-Protection: 0 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com Location: https://ib.adnxs.com/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= Cache-Control: no-store no-cache private with no response body "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2 Host: ib.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-j Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/gif Date: Wed 30 Sep 2026 04:30:23 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=6525282700388545232; SameSite=None; Path=/; Max-Age=7776000; Expires=Tue 29-Dec-2026 04:30:23 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: 514830e5-3968-4f3a-8b22-fb7a6ed712bc X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body31:Tb15,"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 740b0000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "USER32.DLL" at base 76b60000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "WS2_32.DLL" at base 777c0000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "MSVCRT.DLL" at base 77260000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74030000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 74010000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "RPCRT4.DLL" at base 770c0000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 73ff0000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 73fd0000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 73ef0000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73ea0000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73e70000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "KERNEL32.DLL" at base 74f10000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "ADVAPI32.DLL" at base 750f0000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "NTDLL.DLL" at base 778b0000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "WINMM.DLL" at base 73e40000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "POWRPROF.DLL" at base 77840000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "GDI32.DLL" at base 77320000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "USER32" at base 76b60000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d90000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "USERENV.DLL" at base 73d60000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "NETAPI32.DLL" at base 73d40000 "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" loaded module "IPHLPAPI.DLL" at base 73f0000032:T1427,Process "msedge.exe" (UID: 00000000-00002360) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "msedge.exe" (UID: 00000000-00002360) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00007132) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_2360_PRNBKVUAELXIGNYT", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="2360"" Process "msedge.exe" (UID: 00000000-00007348) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00007552) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00002004) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="wHqd58lSoiE00VH", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="5oVGv68", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="wHqd58lSoiE00VH", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\5oVGv68", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\5oVGv68", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00001748) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00004992) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="wHqd58lSoiE00VH", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="5oVGv68", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="wHqd58lSoiE00VH", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\5oVGv68", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\5oVGv68", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753""33:T718,Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00002360) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00007132), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00007348), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004744), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007552), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00005164), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007420), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00004828), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00007680), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00002004), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001748), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00004992), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00006532)34:T718,Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00002360) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00007132), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00007348), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00004744), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007552), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00005164), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007420), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00004828), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00007680), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00002004), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001748), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00004992), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00006532)35:T10da,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 26:7E:93:E6:E3:1A:7D:88:ED:C8:FC:60:E9:19:8B:B8:C9:D7:53:24; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 ECC CA OCSP 06, O=Microsoft Corporation, C=US" (SHA1: 2B:56:9D:5A:30:51:78:CD:39:CD:44:E3:B0:28:BA:2E:14:DF:82:41; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS ECC Root G2, O=Microsoft Corporation, C=US" (SHA1: 9B:C5:75:46:AC:BD:B2:9E:38:8C:D1:79:1B:43:DE:4F:65:9B:84:4B; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7F:A0:5A:CF:9B:4A:AB:B0:DE:0C:FA:FA:29:7D:DF:92:FD:C5:F3:F5; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E; see report for more information) The input sample is signed with a certificate issued by "CN=GeoTrust TLS ECC CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: C6:A7:9F:4F:A3:32:C1:3F:51:DB:C6:1F:5D:2B:37:2F:71:ED:6B:69; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: BF:E7:BA:21:A2:FA:56:71:9B:61:F6:4E:E1:B2:69:D0:B8:0B:44:E5; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: F0:7C:BA:F5:80:4B:9C:1D:DA:1B:51:AD:28:80:50:58:3E:04:60:DE; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: E7:EE:B5:EE:F1:6C:63:04:8D:25:D4:EF:A2:EF:20:DF:18:61:AD:CC; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: 27:E6:66:32:99:D3:40:DF:E5:45:71:CE:CC:EC:01:BE:74:49:5D:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 48:62:BA:29:DB:48:52:50:EC:DE:95:62:15:70:58:A6:E2:13:BC:AE; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 7B:40:95:9C:A6:F3:08:E5:89:4E:40:4C:00:30:B1:DF:B8:63:30:45; see report for more information)36:T7d3,"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")37:Te5a,"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "BE29C413875410CEF5A3FB3925941D7DC558BB942D6DAA272005CF8984E1674F.EXE"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")38:T4a1,"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to touch file "C:\WINDOWS\SysWOW64\apphelp.dll" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to touch file "C:\be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb"39:T503,"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to access non-existent file "C:\FLTLIB.DLL" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to access non-existent file "C:\MSVCP140.DLL" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to access non-existent file "C:\MSVCP140.dll" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to access non-existent file "C:\BCRYPT.DLL" "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" trying to access non-existent file "C:\bcrypt.dll"3a:T4db,Found http requests in header "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent=" Found http requests in header "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent=" Found http requests in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D" Found http requests in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D" Found http requests in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D" Found http requests in header "GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent="3b:T132d,GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67" Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Cookie: uuid2=6525282700388545232 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-j Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image , GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2 Host: ib.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-j Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image 3c:T1375,Contains base62 string in header "222166F75FD3671F181970045E3D66DC;" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "253D222166F75FD3671F181970045E3D6" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "3D222166F75FD3671F181970045E3D66D" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "25253D222166F75FD3671F181970045E3" in header "GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: uuid2=6525282700388545232Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "3D222166F75FD3671F181970045E3D66D" in header "GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Cookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-jPriority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image"3d:T524,Found HTTPS GET request to https://px.ads.linkedin.com/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= Found HTTPS GET request to https://trc.taboola.com/sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= Found HTTPS GET request to https://m.adnxs.com/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D Found HTTPS GET request to https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D Found HTTPS GET request to https://m.adnxs.com/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D Found HTTPS GET request to https://ib.adnxs.com/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent=3e:Tb7d,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008172.00000000.262251.02B30000.00000004.mdmp, 00000000-00008172.00000001.264171.02B30000.00000004.mdmp, 00000000-00008172.00000002.266093.02B30000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008172.00000000.262251.02B30000.00000004.mdmp, 00000000-00008172.00000001.264171.02B30000.00000004.mdmp, 00000000-00008172.00000002.266093.02B30000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00008172.00000000.262251.02B30000.00000004.mdmp, 00000000-00008172.00000001.264171.02B30000.00000004.mdmp, 00000000-00008172.00000002.266093.02B30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008172.00000000.262251.02B30000.00000004.mdmp, 00000000-00008172.00000001.264171.02B30000.00000004.mdmp, 00000000-00008172.00000002.266093.02B30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008172.00000000.262251.02B30000.00000004.mdmp, 00000000-00008172.00000001.264171.02B30000.00000004.mdmp, 00000000-00008172.00000002.266093.02B30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008172.00000000.262251.02B30000.00000004.mdmp, 00000000-00008172.00000001.264171.02B30000.00000004.mdmp, 00000000-00008172.00000002.266093.02B30000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00008172.00000000.262251.02B30000.00000004.mdmp, 00000000-00008172.00000001.264171.02B30000.00000004.mdmp, 00000000-00008172.00000002.266093.02B30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008172.00000000.262251.02B30000.00000004.mdmp, 00000000-00008172.00000001.264171.02B30000.00000004.mdmp, 00000000-00008172.00000002.266093.02B30000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00008172.00000002.266093.69381000.00000004.mdmp")3f:T4e3,Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API "NetGetJoinInformation" (Indicator: "NetGetJoinInformation"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp")40:Tcca,"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")41:T8fc,Process "C:\be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe" connects to 202.61.138.81 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.11 on port 80 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 108.139.47.50 on port 443 (TCP); Domain: "sb.scorecardresearch.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 52.123.255.143 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 69.192.139.87 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.10 on port 443 (TCP); Domain: "r.msftstatic.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.109.72 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.12 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 104.18.41.41 on port 443 (TCP); Domain: "px.ads.linkedin.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 151.101.193.44 on port 443 (TCP); Domain: "trc.taboola.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 68.67.161.182 on port 443 (TCP); Domain: "m.adnxs.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 23.33.22.140 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.109.73 on port 443 (TCP); Domain: "edge-consumer-static.azureedge.net" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.11 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 142.251.219.46 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 142.251.218.129 on port 443 (TCP); Domain: "clients2.googleusercontent.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.10 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.11 on port 443 (TCP)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790742901863,"unified_at":"2026-09-30T04:35:01.863Z","metadata":{"hashes":{"sha256":"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","sha1":"03fc85af764b18ff560da3959f31f30f9940be72","md5":"bd3b31e7315243b0df8fcfe72aa40df0","sha512":"2ffcd32b0cd9fed1434d4cc8a9779c8f34d78e21e13dd559b6f2c724d25a778875bd2988dd1731c293869eb180b4c1dddf0cfe6d145b2037fc7a5c459e855cc8","ssdeep":"48:6Icwm0jt2WdJ8zrD7TLjpSpc1ZsSYr8XxhxhwcRaK:4j6t/SNSYp","ssdeep_chunks":["48:6Icwm0j","48:Icwm0jt","48:cwm0jt2","48:wm0jt2W","48:m0jt2Wd","48:0jt2WdJ","48:jt2WdJ8","48:t2WdJ8z","48:2WdJ8zr","48:WdJ8zrD","48:dJ8zrD7","48:J8zrD7T","48:8zrD7TL","48:zrD7TLj","48:rD7TLjp","48:D7TLjpS","48:7TLjpSp","48:TLjpSpc","48:LjpSpc1","48:jpSpc1Z","48:pSpc1Zs","48:Spc1ZsS","48:pc1ZsSY","48:c1ZsSYr","48:1ZsSYr8","48:ZsSYr8X","48:sSYr8Xx","48:SYr8Xxh","48:Yr8Xxhx","48:r8Xxhxh","48:8Xxhxhw","48:Xxhxhwc","48:xhxhwcR","48:hxhwcRa","48:xhwcRaK","96:6Icwm0j","96:Icwm0jt","96:cwm0jt2","96:wm0jt2W","96:m0jt2Wd","96:0jt2WdJ","96:jt2WdJ8","96:t2WdJ8z","96:2WdJ8zr","96:WdJ8zrD","96:dJ8zrD7","96:J8zrD7T","96:8zrD7TL","96:zrD7TLj","96:rD7TLjp","96:D7TLjpS","96:7TLjpSp","96:TLjpSpc","96:LjpSpc1","96:jpSpc1Z","96:pSpc1Zs","96:Spc1ZsS","96:pc1ZsSY","96:c1ZsSYr","96:1ZsSYr8","96:ZsSYr8X","96:sSYr8Xx","96:SYr8Xxh","96:Yr8Xxhx","96:r8Xxhxh","96:8Xxhxhw","96:Xxhxhwc","96:xhxhwcR","96:hxhwcRa","96:xhwcRaK","48:4j6t/SN","48:j6t/SNS","48:6t/SNSY","48:t/SNSYp"],"imphash":"e82dd51b077167be63c004bed23d0c1e","pehash":"91ffd92d66bfd0b02a7c150cb6bd08f18a4c1c01"},"file_info":{"file_name":"windows_i386.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3584,"entropy":4.08,"compile_timestamp":"2023-10-26T14:42:18","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790721801000,"last_seen":1790742473000,"last_multi_scan":1790742473000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":1454,"raw_size":1536},{"name":".rdata","virtual_address":"0x2000","virtual_size":346,"raw_size":512},{"name":".reloc","virtual_address":"0x3000","virtual_size":12,"raw_size":512}],"section_names":[".text",".rdata",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["urlscanio","commodity","modular","rat","bottles","targeted","vshell","downloader","windows-server-utility"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":3,"threat_actors_count":1,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":62},"sandbox_signatures":{"informative_count":129,"suspicious_count":10,"malicious_count":3,"total":142},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Mikey","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.Jaik.45622","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Mikey-10038331-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/Rozena.ZA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Fake.ao","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 001203481 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_delay_execution","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Loader-IY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Rozena.JO.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.ZQO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Bottles","sources":[{"report_type":"qsp","report_id":""}]},{"value":"VShell","sources":[{"report_type":"qsp","report_id":""}]},{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}],"threat_actors":[{"value":"GENESIS PANDA","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Contains a Wine emulator-related string"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Defense Evasion","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","identifiers":[{"type":"suspicious","value":"PE file has no resource directory"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Attempts to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Identified known pipe name"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008172.00000000.262251.02B30000.00000004.mdmp, 00000000-00008172.00000001.264171.02B30000.00000004.mdmp, 00000000-00008172.00000002.266093.02B30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$25","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00008172.00000001.264171.0F07C000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"msedge.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$26","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00008172.00000000.262251.02B30000.00000004.mdmp, 00000000-00008172.00000001.264171.02B30000.00000004.mdmp, 00000000-00008172.00000002.266093.02B30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$27","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008172-00000C2C-3103293730\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008172-00000C2C-3103293730\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008172-00000C2C-3102906932\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00008172-00000C2C-3103163378\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00008172)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00008172)\n \"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00008172)\n \"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00008172)\n \"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00008172)\n \"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" called \"GetComputerNameExW\" with parameters (UID: 00000000-00008172)\n \"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" called \"GetAdaptersAddresses\" with parameters (UID: 00000000-00008172)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00008172)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008172)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00008172)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 1903)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"px.ads.linkedin.com\"\n \"trc.taboola.com\"\n \"m.adnxs.com\"\n \"ib.adnxs.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"202.61.138.81:443\"\n \"108.139.47.50:443\"\n \"104.18.41.41:443\"\n \"151.101.193.44:443\"\n \"68.67.161.182:443\"\n \"150.171.109.73:443\"\n \"142.251.218.129:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$2f","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"px.ads.linkedin.com\" (Indicator: \"linkedin.com\"; File: \"PCAP\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$30","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"msedge.exe\" (UID: 00000000-00002360)\n Launches browser \"msedge.exe\" (UID: 00000000-00007132)\n Launches browser \"msedge.exe\" (UID: 00000000-00007348)\n Launches browser \"msedge.exe\" (UID: 00000000-00004744)\n Launches browser \"msedge.exe\" (UID: 00000000-00007552)\n Launches browser \"msedge.exe\" (UID: 00000000-00005164)\n Launches browser \"msedge.exe\" (UID: 00000000-00007420)\n Launches browser \"msedge.exe\" (UID: 00000000-00004828)\n Launches browser \"msedge.exe\" (UID: 00000000-00007680)\n Launches browser \"msedge.exe\" (UID: 00000000-00002004)\n Launches browser \"msedge.exe\" (UID: 00000000-00001748)\n Launches browser \"msedge.exe\" (UID: 00000000-00004992)\n Launches browser \"msedge.exe\" (UID: 00000000-00006532)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77200000\n \"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73E80000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 770C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" file has an entrypoint instructions - \"jmp\t0x401005,push\tebp,mov\tebp, esp,and\tesp, 0xfffffff8,sub\tesp, 0x364,push\tebx,push\tesi,push\tedi,lea\tecx, [esp + 0x98],call\t0x40145f,lea\teax, [esp + 0x160],push\teax,push\t0x80,call\tdword ptr [esp + 0xe4],mov\tesi, dword ptr [esp + 0xd0],lea\teax, [esp + 0x54],push\teax,lea\teax, [esp + 0x80],mov\tdword ptr [esp + 0x70], 0x73257325,push\teax,lea\teax, [esp + 0x168],mov\tword ptr [esp + 0x78], 0x7325,push\teax,lea\teax, [esp + 0x78],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$32","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"clients2.googleusercontent.com\"\n \"edge-consumer-static.azureedge.net\"\n \"ib.adnxs.com\"\n \"m.adnxs.com\"\n \"px.ads.linkedin.com\"\n \"r.msftstatic.com\"\n \"sb.scorecardresearch.com\"\n \"trc.taboola.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$33","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$34","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$35","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" queries basic process information of the \"C:\\be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" (UID: 8172)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains a Wine emulator-related string\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\LOG_DE.LOG\"\n \"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\log_de.log\"\n \"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" trying to access non-existent file \"\\Device\\RasAcd\"\n \"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\LOG_DE-0.LOG\"\n \"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}\"\n \"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" writes file \"\\device\\namedpipe\\wkssvc\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00008172-00000C2C-3103388231\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"\"PingCheckTime\":\"PingCheckTime\":\" (Indicator: \"\"ping\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"\"ping\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00008172-00000C2C-3103587292\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"$3a","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"jWSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00008172-00000C2C-3102902451\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00008172-00000C2C-3103605221\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00008172-00000C2C-3103607509\")\n Found reference to API \"jWSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00008172-00000C2C-3102902451\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"202.61.138.81\"\n \"02.61.138.81\"\n Potential IP \"192.168.0.2\" found in string \"{\"Id\":0,\"IsConnect\":false,\"VerifyKey\":\"\",\"Tp\":\"tcp\",\"Addr\":\"\",\"Remark\":\"\",\"Status\":false,\"LocalIP\":\"192.168.0.2\",\"UserName\":\"\", Potential IP \"192.168.0.2\" found in string \"{\"Id\":0\n\"IsConnect\":false\n\"VerifyKey\":\"\"\n\"Tp\":\"tcp\"\n\"Addr\":\"\"\n\"Remark\":\"\"\n\"Status\":false\n\"LocalIP\":\"192.168.0.2\"\n\"UserName\":\"wHqd58lSoiE00VH\\\\5oVGv68\"\n\"HostName\":\"wHqd58lSoiE00VH\"\n\"Location\":\"\"\n\"OsName\":\"windows_386\"\n\"ProcessName\":\"\"\n \"192.168.0.2\"\n \"202.61.138.81:443\"\n Potential IP \"202.61.138.81\" found in string \"o$t{\"server\":\"202.61.138.81:443\",\"type\":\"tcp\",\"vkey\":\"qwe123qwe\",\"proxy\":\"\",\"salt\":\"qwe123qwe\",\"l\":false,\"e\":false,\"d\":30,\"h\":10}\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"px.ads.linkedin.com\"\n Heuristic match: \"trc.taboola.com\"\n Heuristic match: \"m.adnxs.com\"\n Heuristic match: \"ib.adnxs.com\"\n Heuristic match: \"clients2.googleusercontent.com\"\n Heuristic match: \"edge-consumer-static.azureedge.net\"\n Heuristic match: \"r.msftstatic.com\"\n Heuristic match: \"sb.scorecardresearch.com\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$3b","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$3c","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"px.ads.linkedin.com\" has high entropy\n Contacted domain: \"clients2.googleusercontent.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Identified known pipe name","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00008172-00000CCE-3103519150\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":3,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"px.ads.linkedin.com\" (13 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$3d","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"clients2.googleusercontent.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"202.61.138.81\" on port \"443\"\n HTTPS traffic to \"108.139.47.50\" on port \"443\"\n HTTPS traffic to \"104.18.41.41\" on port \"443\"\n HTTPS traffic to \"151.101.193.44\" on port \"443\"\n HTTPS traffic to \"68.67.161.182\" on port \"443\"\n HTTPS traffic to \"150.171.109.73\" on port \"443\"\n HTTPS traffic to \"142.251.218.129\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00008172\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--profile-directory=Default\" (Indicator: \"--profile-directory=\"; File: \"msedge.exe\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"00000000-00008172-00000C2C-3103369661\")\n Found string \"GetClipboardData\" (Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyA\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"VkKeyScanA\" (Indicator: \"VkKeyScan\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 73D20000\n \"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" loaded module \"%WINDIR%\\SysWOW64\\samlib.dll\" at 73CE0000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"QueryInformationProcess\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.0F000000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"master secret\" (Indicator: \"secret\"; Source: \"00000000-00008172.00000001.264171.68F9D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00008172)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00008172.00000001.264171.02B30000.00000004.mdmp, 00000000-00008172.00000002.266093.02B30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00008172.00000002.266093.69381000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" opened \"\\Device\\KsecDD\"\n \"msedge.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"PE file has no resource directory","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" has no resource directory","origin":"Static Parser","mitre_attack_id":"T1027.008","relevance":7,"id":"static-9002","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET DROP Spamhaus DROP Listed Traffic Inbound group 55\" (SID: 2400054, Rev: 4798, Severity: 2) categorized as \"Misc Attack\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/23 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to retrieve NetBIOS or DNS name associated with the local computer","description":"\"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe\" called \"GetComputerNameExW\" with parameters {\"NameType\": \"5\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-287","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 202.61.138.81 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"$41","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00008172.00000001.264171.38480000.00000004.mdmp, 00000000-00008172.00000002.266093.38480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"Sleep","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/23 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 8 domains and 8 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]}],"intel_graph":{"map":{"Adversary:ff9521f9f6d173fbe9eeb9a6bd457fae65b9cb4fac452f5200e0e27d4b546bce":{"type":"Adversary","value":"GENESIS PANDA","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Domain:clients2.googleusercontent.com":{"type":"Domain","value":"clients2.googleusercontent.com"},"Domain:edge-consumer-static.azureedge.net":{"type":"Domain","value":"edge-consumer-static.azureedge.net"},"Domain:ib.adnxs.com":{"type":"Domain","value":"ib.adnxs.com"},"Domain:m.adnxs.com":{"type":"Domain","value":"m.adnxs.com"},"Domain:px.ads.linkedin.com":{"type":"Domain","value":"px.ads.linkedin.com"},"Domain:r.msftstatic.com":{"type":"Domain","value":"r.msftstatic.com"},"Domain:sb.scorecardresearch.com":{"type":"Domain","value":"sb.scorecardresearch.com"},"Domain:trc.taboola.com":{"type":"Domain","value":"trc.taboola.com"},"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f":{"type":"File","value":"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat Bottles","File reported as trojan by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat Bottles","confirmed relationship with a Threat VShell","confirmed relationship with an Adversary GENESIS PANDA"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"Ip:104.18.41.41":{"type":"Ip","value":"104.18.41.41"},"Ip:108.139.47.50":{"type":"Ip","value":"108.139.47.50"},"Ip:142.251.218.129":{"type":"Ip","value":"142.251.218.129"},"Ip:150.171.109.73":{"type":"Ip","value":"150.171.109.73"},"Ip:150.171.27.10":{"type":"Ip","value":"150.171.27.10"},"Ip:151.101.193.44":{"type":"Ip","value":"151.101.193.44"},"Ip:202.61.138.81":{"type":"Ip","value":"202.61.138.81"},"Ip:68.67.161.182":{"type":"Ip","value":"68.67.161.182"},"Threat:0acb0c1610910fcaa5893d3bdef03ab03ee515118a39b48f5a4e5b170926706d":{"type":"Threat","value":"Bottles","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat Bottles","confirmed relationship with a Threat","confirmed relationship with an Adversary GENESIS PANDA"]}},"Threat:cc200a3f4d1eb75af2e923a266838c2a76ddfc33d9943a7e9cdb27299931394b":{"type":"Threat","value":"VShell","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Url:/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D":{"type":"Url","value":"/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D"},"Url:/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D":{"type":"Url","value":"/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D"},"Url:/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D":{"type":"Url","value":"/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D"},"Url:/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent=":{"type":"Url","value":"/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent="},"Url:/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent=":{"type":"Url","value":"/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent="},"Url:/sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent=":{"type":"Url","value":"/sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent="},"Url:cb33f49b6212cebd9825b7e9ebaf09facea8876bc1e0f3df4576d26ddb3e7a58":{"type":"Url","value":"tcp://202.61.138.81:443","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}}},"chains":[{"id":"1554711369896520154","root":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat Bottles","File reported as trojan by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat Bottles","confirmed relationship with a Threat VShell","confirmed relationship with an Adversary GENESIS PANDA"]}},{"id":"1554711374873159973","root":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","edges":[{"edge_kind":"is_threat","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Threat:0acb0c1610910fcaa5893d3bdef03ab03ee515118a39b48f5a4e5b170926706d"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected","confirmed relationship with a Threat","confirmed relationship with an Adversary GENESIS PANDA"]}},{"id":"1554711363828398560","root":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Threat:cc200a3f4d1eb75af2e923a266838c2a76ddfc33d9943a7e9cdb27299931394b"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1554711371187234165","root":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","edges":[{"edge_kind":"contains_c2_config","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Url:cb33f49b6212cebd9825b7e9ebaf09facea8876bc1e0f3df4576d26ddb3e7a58"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1554711374637119979","root":"Threat:0acb0c1610910fcaa5893d3bdef03ab03ee515118a39b48f5a4e5b170926706d","edges":[{"edge_kind":"used_by","from_key":"Threat:0acb0c1610910fcaa5893d3bdef03ab03ee515118a39b48f5a4e5b170926706d","to_key":"Adversary:ff9521f9f6d173fbe9eeb9a6bd457fae65b9cb4fac452f5200e0e27d4b546bce"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","edges":[{"edge_kind":"contacted_ip","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Ip:202.61.138.81"},{"edge_kind":"contacted_ip","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Ip:108.139.47.50"},{"edge_kind":"contacted_ip","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Ip:104.18.41.41"},{"edge_kind":"contacted_ip","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Ip:151.101.193.44"},{"edge_kind":"contacted_ip","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Ip:68.67.161.182"},{"edge_kind":"contacted_ip","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Ip:150.171.109.73"},{"edge_kind":"contacted_ip","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Ip:142.251.218.129"},{"edge_kind":"contacted_domain","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Domain:clients2.googleusercontent.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.googleusercontent.com","to_key":"Ip:142.251.218.129"},{"edge_kind":"contacted_domain","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Domain:edge-consumer-static.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edge-consumer-static.azureedge.net","to_key":"Ip:150.171.109.73"},{"edge_kind":"contacted_domain","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Domain:ib.adnxs.com"},{"edge_kind":"resolves_to","from_key":"Domain:ib.adnxs.com","to_key":"Ip:68.67.161.182"},{"edge_kind":"contacted_domain","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Domain:m.adnxs.com"},{"edge_kind":"resolves_to","from_key":"Domain:m.adnxs.com","to_key":"Ip:68.67.161.182"},{"edge_kind":"contacted_domain","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Domain:px.ads.linkedin.com"},{"edge_kind":"resolves_to","from_key":"Domain:px.ads.linkedin.com","to_key":"Ip:104.18.41.41"},{"edge_kind":"contacted_domain","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Domain:r.msftstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:r.msftstatic.com","to_key":"Ip:150.171.27.10"},{"edge_kind":"contacted_domain","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Domain:sb.scorecardresearch.com"},{"edge_kind":"resolves_to","from_key":"Domain:sb.scorecardresearch.com","to_key":"Ip:108.139.47.50"},{"edge_kind":"contacted_domain","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Domain:trc.taboola.com"},{"edge_kind":"resolves_to","from_key":"Domain:trc.taboola.com","to_key":"Ip:151.101.193.44"},{"edge_kind":"contacted_url","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Url:/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent="},{"edge_kind":"contacted_url","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Url:/sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent="},{"edge_kind":"contacted_url","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Url:/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D"},{"edge_kind":"contacted_url","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Url:/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D"},{"edge_kind":"contacted_url","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Url:/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D"},{"edge_kind":"contacted_url","from_key":"File:be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","to_key":"Url:/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent="}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":14,"spawned_processes_count":14,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":50,"imported_dlls_count":162,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":24,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":1,"contacted_hosts_count":7,"dns_resolutions_count":8,"contacted_urls_count":6,"http_requests_count":6},"behavior_tags":["urlscanio","commodity","modular","rat","bottles","targeted","vshell","downloader","windows-server-utility"],"sample_flags":["Network Traffic","User Comment"],"sandbox_reports":[{"id":"6abc8fc80254677e6a0138d2","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Rozena.JO.gen","contacted_countries":["SGP","USA"],"submit_name":"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe","analysis_start_time":"2026-09-30T04:27:53+00:00","indicators_count":{"informative":129,"suspicious":14,"malicious":3},"tags":["Network Traffic","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"202.61.138.81","port":443,"protocol":"TCP","country":"Singapore","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"address":"108.139.47.50","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"address":"104.18.41.41","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"address":"151.101.193.44","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"address":"68.67.161.182","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"address":"150.171.109.73","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"address":"142.251.218.129","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]}],"dns_resolutions":[{"domain":"clients2.googleusercontent.com","address":"142.251.218.129","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"domain":"edge-consumer-static.azureedge.net","address":"150.171.109.73","ttl":30,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Microsoft Corporation","registrar_name_servers":"prd2.azuredns-cloud.net","registrar_creation_date":"2014-01-22T08:14:52+00:00","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"domain":"ib.adnxs.com","address":"68.67.161.182","ttl":13,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"domain":"m.adnxs.com","address":"68.67.161.182","ttl":15,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"domain":"px.ads.linkedin.com","address":"104.18.41.41","ttl":285,"country":"-","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"domain":"r.msftstatic.com","address":"150.171.27.10","ttl":2991,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"domain":"sb.scorecardresearch.com","address":"108.139.47.50","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"domain":"trc.taboola.com","address":"151.101.193.44","ttl":1,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]}],"http_requests":[{"host":"px.ads.linkedin.com","host_ip":"104.18.41.41:443","url":"/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent=","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2\nHost: px.ads.linkedin.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: bcookie=\"v=2&1391f723-91e0-4064-8cb8-08df8de6ce67\"\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"host":"trc.taboola.com","host_ip":"151.101.193.44:443","url":"/sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent=","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2\nHost: trc.taboola.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"host":"m.adnxs.com","host_ip":"68.67.161.182:443","url":"/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D","method":"GET","response_code":"307","response_phrase":"Temporary Redirect","header":"GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2\nHost: m.adnxs.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nX-Edge-Shopping-Flag: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"host":"m.adnxs.com","host_ip":"68.67.161.182:443","url":"/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/2\nHost: m.adnxs.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: uuid2=6525282700388545232\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nX-Edge-Shopping-Flag: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"host":"m.adnxs.com","host_ip":"68.67.161.182:443","url":"/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D222166F75FD3671F181970045E3D66DC%26gdpr%3D0%26gdpr_consent%3D HTTP/2\nHost: m.adnxs.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-j\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nX-Edge-Shopping-Flag: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"host":"ib.adnxs.com","host_ip":"68.67.161.182:443","url":"/setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent=","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /setuid?entity=483&code=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2\nHost: ib.adnxs.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nCookie: anj=dTM7k!M4/8CxrEQF']wIg2GVVn35c*!]tbP6j2F-XstGt!@Df>$o+-j\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nX-Edge-Shopping-Flag: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]}],"embedded_urls":[{"value":"tcp://202.61.138.81:443","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}],"processes":[{"pid":8172,"ppid":0,"name":"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe","command_line":"","sha256":"be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f","normalized_path":"C:\\be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f.exe","uid":"00000000-00008172","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":2360,"ppid":0,"name":"msedge.exe","command_line":"--profile-directory=Default","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00002360","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":7132,"ppid":2360,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x29c,0x2c4,0x2c8,0x2c0,0x2d0,0x7ff9e56d0f18,0x7ff9e56d0f24,0x7ff9e56d0f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002360","uid":"00000000-00007132"},{"pid":7348,"ppid":2360,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1588,i,7353420073107622704,1628924856381118607,262144 --field-trial-handle=1808,i,2928248375795696395,858144782682650243,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1804 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002360","uid":"00000000-00007348"},{"pid":4744,"ppid":2360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1828,i,6990688756820756057,15934456007633724292,524288 --field-trial-handle=1808,i,2928248375795696395,858144782682650243,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1944 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002360","uid":"00000000-00004744"},{"pid":7552,"ppid":2360,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1790738390004058 --launch-time-ticks=4218579274 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=2960,i,11667206789178784306,17544300964551282012,2097152 --field-trial-handle=1808,i,2928248375795696395,858144782682650243,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2996 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002360","uid":"00000000-00007552"},{"pid":5164,"ppid":2360,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1790738390004058 --launch-time-ticks=4218580531 --skip-read-main-dll --metrics-shmem-handle=2968,i,18112852866730458576,2880853500633920450,2097152 --field-trial-handle=1808,i,2928248375795696395,858144782682650243,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3016 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002360","uid":"00000000-00005164"},{"pid":7420,"ppid":2360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2180,i,16212624843839545999,1224658087186766663,524288 --field-trial-handle=1808,i,2928248375795696395,858144782682650243,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2716 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002360","uid":"00000000-00007420"},{"pid":4828,"ppid":2360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=4968,i,17923031568991921666,5362232177815825674,524288 --field-trial-handle=1808,i,2928248375795696395,858144782682650243,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4888 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002360","uid":"00000000-00004828"},{"pid":7680,"ppid":2360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=4956,i,7642376257186092954,15765013093056641701,524288 --field-trial-handle=1808,i,2928248375795696395,858144782682650243,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5012 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002360","uid":"00000000-00007680"},{"pid":2004,"ppid":2360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5444,i,1259499155481957856,5020551979742875915,524288 --field-trial-handle=1808,i,2928248375795696395,858144782682650243,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=6176 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002360","uid":"00000000-00002004"},{"pid":1748,"ppid":2360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6304,i,2089913857237597311,17807937533340976426,524288 --field-trial-handle=1808,i,2928248375795696395,858144782682650243,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=6256 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002360","uid":"00000000-00001748"},{"pid":4992,"ppid":2360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=6260,i,10785692011085344827,14095217621325602171,524288 --field-trial-handle=1808,i,2928248375795696395,858144782682650243,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5444 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002360","uid":"00000000-00004992"},{"pid":6532,"ppid":2360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=6312,i,16220576857444956347,16736392000398965714,524288 --field-trial-handle=1808,i,2928248375795696395,858144782682650243,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6292 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00002360","uid":"00000000-00006532"}],"all_imported_dlls":["dmcmnutils.dll","Windows.System.Profile.RetailInfo.dll","aepic.dll","iertutil.dll","cryptsp.dll","rmclient.dll","secur32.dll","microsoft_shell_integration.dll","sppc.dll","netprofm.dll","bcryptprimitives.dll","samcli.dll","Windows.Networking.Connectivity.dll","npmproxy.dll","PCPKsp.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","slwga.dll","ntdll.dll","user32.dll","wldp.dll","deviceaccess.dll","ResourcePolicyClient.dll","apphelp.dll","dhcpcsvc6.dll","dsreg.dll","comctl32.dll","linkinfo.dll","Windows.Security.Authentication.OnlineId.dll","msvcrt.dll","shell32.dll","actxprxy.dll","ntasn1.dll","cryptbase.dll","dhcpcsvc.dll","ntmarta.dll","msctf.dll","TextInputFramework.dll","sxs.dll","tbs.dll","d3dcompiler_47.dll","mswsock.dll","NapiNSP.dll","nsi.dll","combase.dll","advapi32.dll","pnrpnsp.dll","wkscli.dll","clbcatq.dll","fwbase.dll","oneds.dll","d3d10warp.dll","gdi32.dll","ole32.dll","oneauth.dll","cldapi.dll","telclient.dll","wscapi.dll","samlib.dll","KBDUS.DLL","DWrite.dll","wtsapi32.dll","rometadata.dll","domain_actions.dll","rsaenh.dll","OneCoreUAPCommonProxyStub.dll","slc.dll","KernelBase.dll","devobj.dll","wow64win.dll","sechost.dll","fltLib.dll","version.dll","RTWorkQ.dll","win32u.dll","Windows.Security.Authentication.Web.Core.dll","vk_swiftshader.dll","gpapi.dll","wintrust.dll","mscms.dll","wlanapi.dll","wwapi.dll","winrnr.dll","netutils.dll","biwinrt.dll","wevtapi.dll","oleacc.dll","IPHLPAPI.DLL","rasadhlp.dll","msedge_elf.dll","msedge.dll","mdmregistration.dll","Windows.UI.Immersive.dll","dbghelp.dll","VxSSL32.dll","rpcrt4.dll","powrprof.dll","userenv.dll","SHCore.dll","CoreUIComponents.dll","FirewallAPI.dll","profapi.dll","well_known_domains.dll","ffmpeg.dll","dusmapi.dll","imagehlp.dll","ws2_32.dll","shlwapi.dll","Windows.UI.dll","directmanipulation.dll","mf.dll","wow64.dll","vcruntime140.dll","cfgmgr32.dll","msasn1.dll","twinapi.appcore.dll","atlthunk.dll","ucrtbase.dll","imm32.dll","winmm.dll","winmmbase.dll","crypt32.dll","CoreMessaging.dll","ncryptprov.dll","kernel32.dll","msvcp_win.dll","msvcp140.dll","twinapi.dll","setupapi.dll","BitsProxy.dll","FWPUCLNT.DLL","WinTypes.dll","webauthn.dll","deviceassociation.dll","mfplat.dll","DataExchange.dll","urlmon.dll","sspicli.dll","ncrypt.dll","libEGL.dll","onnxruntime.dll","gdi32full.dll","oleaut32.dll","dwmapi.dll","winsta.dll","winhttp.dll","propsys.dll","dxgi.dll","uxtheme.dll","netapi32.dll","windows.storage.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","msvcp110_win.dll","dpapi.dll","dcomp.dll","wow64cpu.dll","kernel.appcore.dll","d3d11.dll","Windows.Devices.Enumeration.dll","libGLESv2.dll","nlaapi.dll","dnsapi.dll","bcrypt.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\crashpad_2360_PRNBKVUAELXIGNYT","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.2360.7120.18276675141898189654","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.2360.7120.18419769648300772081","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.2360.7120.5279964599951276100","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.2360.7120.3528587718455299694","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.2360.7120.16040161775456651337","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.2360.7120.10516827564925855603","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.2360.7120.13561589751740948057","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.2360.7120.14660483383340561575","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.2360.5660.18446057701220068875","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.2360.5660.14405665901779608898","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.2360.7120.7296749428914487572","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.2360.7120.16695789924019974855","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.2360.5660.1396611400811311510","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.2360.5660.16695435575149496497","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.2360.5660.10730365330736924510","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.2360.5660.15688086992879246272","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.7552.1108.16007490634767833802","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"path":"pipe\\LOCAL\\mojo.5164.4272.12418417481616610919","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2360:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2360:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"Local\\SM0:2360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"SM0:2360:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"SM0:2360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"Local\\SM0:2360:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7348:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7348:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"SM0:7348:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"Local\\SM0:7348:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"SM0:4744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"Local\\SM0:4744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"SM0:7420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"Local\\SM0:7420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4828:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4828:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"Local\\SM0:4828:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"SM0:4828:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7680:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7680:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"Local\\SM0:7680:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"SM0:7680:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"Local\\SM0:2004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"SM0:2004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1748:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1748:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"SM0:1748:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"Local\\SM0:1748:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4992:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4992:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"Local\\SM0:4992:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"SM0:4992:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"Local\\SM0:6532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]},{"name":"SM0:6532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abc8fc80254677e6a0138d2"}]}]}},"report_ids":{"sandbox_job_ids":["6abc8fc80254677e6a0138d2"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Bottles Sample be29c4138754… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample be29c4138754…. Malware family: Bottles. Threat score 100/100. 14/25 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f"}],["$","meta","4",{"property":"og:title","content":"Malicious Bottles Sample be29c4138754… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample be29c4138754…. Malware family: Bottles. Threat score 100/100. 14/25 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/be29c413875410cef5a3fb3925941d7dc558bb942d6daa272005cf8984e1674f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Bottles Sample be29c4138754… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample be29c4138754…. Malware family: Bottles. Threat score 100/100. 14/25 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L42","11",{}]]