26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample df67607c6f5c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample df67607c6f5c…. Malware family: Mint.Zard.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/df67607c6f5c8b3262e7c18f07ccbd35728771bacc3b963418c204f4d39b3ff5","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","df67607c6f5c8b3262e7c18f07ccbd35728771bacc3b963418c204f4d39b3ff5"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"df67607c6f5c8b3262e7c18f07ccbd35728771bacc3b963418c204f4d39b3ff5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T92d," HTTP/1.1 200 OK Date: Tue 05 May 2026 12:19:12 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=kVzgBSHtQZeE.2FOq4BzqnGS0RCJwBaqJQ.GCycYT4s-1777983552.590106-1.0.1.1-Cd.I7ct4Iy5vQ3WY9MNsz_2lJdYeCRel.GYjQGAZ2g5UoO3vIEcZNf3_dVcnKPPOtAlcZpxb_Ud0kEbD5aoLN55DbbQDbA0xlqJQU_rtPzgSI5lfr.Rf6Af8u6sLecDs; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Tue 05 May 2026 12:49:12 GMT Server: cloudflare CF-RAY: 9f6fb133a929ced7-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /3/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 05 May 2026 12:19:13 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Sun 19 Apr 2026 09:28:25 GMT Connection: keep-alive ETag: "69e4a039-6" Accept-Ranges: bytes with response body ==>33373438380A....... "GET /3/18366.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 05 May 2026 12:19:13 GMT Content-Type: text/plain Content-Length: 258030 Last-Modified: Sun 19 Apr 2026 08:49:05 GMT Connection: keep-alive ETag: "69e49701-3efee" Accept-Ranges: bytes with response body ==>407961686F6F2E636F2E6A703A4B61736E61566153392D0A736F776861743230303540636F782E6E65743A736F7768617432303035320A73646A6B6A68646B73....... "GET /REST/v1/Imagery/Map/roadondemandfull/40.751,-73.964/5?mapSize=268,136&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|lv:1_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US HTTP/2 Host: ecn.dev.virtualearth.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Date: Tue 05 May 2026 12:20:58 GMT X-Azure-Ref: 20260504T131731Z-174448969d5l5x8mhC1DFWcman0000000bn0000000001wp3 X-Bm-Fe-Elapsed: 8 Access-Control-Allow-Headers: Content-Type X-FD-Features X-FD-FLIGHT PreferAnonymous X-Ms-Bm-Ws-Info: 0 X-Bm-Traceid: 84638427282d12a9811845947493b659 X-Bm-Srv: mapsplatform-frontend-79cd649b5c-4hjlx mapsplatform-imagery-service-6989b96758-rh8kq Cache-Control: public max-age=2532 Alt-Svc: h3=":443"; ma=93600 h3-29=":443"; ma=93600 Access-Control-Allow-Methods: POST GET OPTIONS Aks_4209_weight: 100 with response body ==>BINARY_CONTENT....... "GET /REST/v1/Imagery/Map/roadondemandfull/40.780,-73.970/5?mapSize=268,136&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|lv:1_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US HTTP/2 Host: ecn.dev.virtualearth.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: u=1, i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Date: Tue 05 May 2026 12:21:11 GMT X-Azure-Ref: 20260505T105928Z-174448969d5l5x8mhC1DFWcman0000000fy0000000003q42 X-Bm-Fe-Elapsed: 11 Access-Control-Allow-Headers: Content-Type X-FD-Features X-FD-FLIGHT PreferAnonymous X-Ms-Bm-Ws-Info: 0 X-Bm-Traceid: 142aa445ee931ad2e2eabc56972d7ec1 X-Bm-Srv: mapsplatform-frontend-68d77dbbd8-wctp9 mapsplatform-imagery-service-74647c977f-f6j98 Cache-Control: public max-age=53648 Alt-Svc: h3=":443"; ma=93600 h3-29=":443"; ma=93600 Access-Control-Allow-Methods: POST GET OPTIONS Aks_4209_weight: 100 with response body ==>BINARY_CONTENT....... "GET /mouse-gesture/config.json HTTP/2 Host: edge-consumer-static.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> no response "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Tue 05 May 2026 12:21:42 GMT Set-Cookie: lidc="b=TGST08:s=T:r=T:a=T:p=T:g=3267:u=1:x=1:i=1777983702:t=1778070102:v=2:sig=AQGo36noMDyWhr_m2BgrO7sb-TZE8qCi"; Expires=Wed 06 May 2026 12:21:42 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure X-Li-Uuid: AAZRERcD/modOC6Fz3BCfw== X-Li-Fabric: prod-ltx1 X-Msedge-Ref: Ref A: 5C59B06DBE3841B6A131A5AB1749A534 Ref B: BY1AA1072315062 Ref C: 2026-05-05T12:21:42Z Vary: Accept-Encoding X-Li-Proto: http/2 Content-Encoding: gzip X-Li-Pop: afd-prod-ltx1-x X-Cache: CONFIG_NOCACHE Alt-Svc: h3=":443"; ma=86400 Linkedin-Action: 1 with response body ==>BINARY_CONTENT....... "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-Os: Windows Priority: u=4, i Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Accept-Encoding: gzip, deflate, br, zstd Sec-Mesh-Client-Os-Version: 10.0.16299 Sec-Mesh-Client-Webview: 0 Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-chrome-extension X-Guploader-Uploadid: AAVLpEjmVPuFnOJ5yvrAAdacrntf3_O3cl2_X_Otv2clFMKCNErM_na8Noc13K6vn0MuIOkw Date: Mon 04 May 2026 22:52:18 GMT Server: UploadServer Last-Modified: Tue 14 Apr 2026 15:03:12 GMT Expires: Tue 04 May 2027 22:52:18 GMT Etag: 1db0e9cf_2cf27c25_ffe43034_bc33e3f0_b05b60af Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 48565 X-Goog-Hash: crc32c=939wAg== with response body ==>BINARY_CONTENT....... "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Date: Tue 05 May 2026 12:21:43 GMT Server: nginx X-Service-Version: v1 X-Served-By: cache-lax-kwhp1940121-LAX P3p: policyref="http://trc.taboola.com/p3p.xml" CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Pragma: no-cache X-Cache-Hits: 0 Via: 1.1 varnish Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-To-Nlb-Rtt: 1313 X-Timer: S1777983704.841577 VS0 VE4 X-Cache: MISS X-Vcl-Time-Ms: 4 Cache-Control: no-cache no-store Accept-Ranges: bytes with no response body "GET /mapuid?member=280&user=32DFF8A43A9F6A9B15B5EE573B1A6B37;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D32DFF8A43A9F6A9B15B5EE573B1A6B37%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 307 Temporary Redirect Content-Type: text/html; charset=utf-8 Date: Tue 05 May 2026 12:21:44 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=5370224008109350152; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon 03-Aug-2026 12:21:44 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: cdefb559-cc64-4346-8b0e-ff07088a7862 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D32DFF8A43A9F6A9B15B5EE573B1A6B37%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D32DFF8A43A9F6A9B15B5EE573B1A6B37%252526gdpr%25253D0%252526gdpr_consent%25253D Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body2d:T725,"126mx00.mxmail.netease.com" Pattern match: "http://130.12.180.190/3/18366.txt" Heuristic match: "msn.com" Heuristic match: "x23.au.com" Heuristic match: "x1.seznam.cz" Heuristic match: "x-ha02.web.de" Heuristic match: "ahoodns.net" Heuristic match: "163mx00.mxmail.netease.com" Heuristic match: "163mx01.mxmail.netease.com" Heuristic match: "mx2.mxge.comcast.net" Heuristic match: "163mx02.mxmail.netease.com" Heuristic match: "cast.net" Heuristic match: "ed.com" Heuristic match: "mx1c1.comcast.net" Heuristic match: "63mx01.mxmail.netease.com" Heuristic match: "xcs.net" Heuristic match: "n.outlook.com" Heuristic match: "mtp-in.libero.it" Heuristic match: "mtp-in2.orange.fr" Heuristic match: "ahoo.com" Heuristic match: "x01.windstream.net" Heuristic match: "ogeco.ca" Heuristic match: "x2c1.comcast.net" Heuristic match: "himneyrockpark.com" Heuristic match: "eznam.cz" Heuristic match: "x-ha.skymail.net.br" Heuristic match: "x1-us1.ppe-hosted.com" Heuristic match: "x1.mxge.comcast.net" Heuristic match: "ta6.am0.yahoodns.net" Heuristic match: "x2.mxge.comcast.net" Heuristic match: "x002.tt.xion.oxcs.net" Heuristic match: "x004.tt.xion.oxcs.net" Heuristic match: "lt1.aspmx.l.google.com" Heuristic match: "x2-us1.ppe-hosted.com" Heuristic match: "x.centurylink.net" Heuristic match: "x.dka.mailcore.net" Heuristic match: "63mx03.mxmail.netease.com" Heuristic match: "x2a1.comcast.net" Heuristic match: "x1h1.comcast.net" Heuristic match: "x1a1.comcast.net" Heuristic match: "mx00.t-online.de" Heuristic match: "mx01.t-online.de" Heuristic match: "mx02.t-online.de" Heuristic match: "ast.net" Heuristic match: "5.mail.naver.com" Heuristic match: "du-univali-br.mail.protection.outlook.com" Heuristic match: "antamaria-wa-edu-au.mail.protection.outlook.com" Heuristic match: "2-us1.ppe-host002.tt.xion.oxcs.net" Heuristic match: "mx003.tt.xion.oxcs.net" Heuristic match: "o`vzmx23.au.com" Heuristic match: "mkmzmx1.seznam.cz" Heuristic match: "!dmx.cogeco.net" Heuristic match: "ail.net" Heuristic match: "+163mx03.mxmail.netease.com" Heuristic match: ".mail.protection.outlook.com" Heuristic match: "t.net" Heuristic match: ".outlook.com" Heuristic match: "vm.edu" Heuristic match: ".openwave.ai" Heuristic match: "fmx.dka.mailcore.net" Heuristic match: "ssmtp-in2.orange.fr" Heuristic match: "ibmx01.windstream.net" Heuristic match: "kmx-aol.mail.gm0.yahoodns.net" Heuristic match: "entral.mx.a.cloudfilter.net" Heuristic match: "om.olc.protection.outlook.com" Heuristic match: "x1.free.fr" Heuristic match: "mxmail.netease.com" Heuristic match: "loudfilter.net" Heuristic match: "indstream.net" Heuristic match: "mtp-in.sfr.fr" Heuristic match: "tease.com" Heuristic match: "mx21.au.com" Heuristic match: "c1.comcast.net" Heuristic match: "x.sympatico.ca" Heuristic match: "mcast.net" Heuristic match: ".barracudanetworks.com" Heuristic match: "omechoice.co.uk" Heuristic match: "ta7.am0.yahoodns.net" Heuristic match: "x1.mail.yahoo.co.jp" Heuristic match: "lt2.aspmx.l.google.com" Heuristic match: "x1c1.comcast.net" Heuristic match: "126mx01.mxmail.netease.com" Heuristic match: ".comcast.net" Heuristic match: "ion.outlook.com" Heuristic match: "k.com" Heuristic match: "mtpin.eastlink.ca" Heuristic match: "spmx.l.google.com" Heuristic match: "x3.vodafonemail.de" Heuristic match: "x4.mail.naver.com" Heuristic match: "ap.fastly.net" Heuristic match: "pc.olc.protection.outlook.com" Heuristic match: "hw-central.mx.a.cloudfilter.net" Heuristic match: "ur.olc.protection.outlook.com" Heuristic match: "26mx03.mxmail.netease.com" Heuristic match: "26mx02.mxmail.netease.com" Heuristic match: "x-eu.mail.am0.yahoodns.net" Heuristic match: "e.com.deliverymx1h1.comcast.net" Heuristic match: "x2h1.comcast.net" Heuristic match: "zbmx.rcn.com" Heuristic match: "{smtp-in.sfr.fr" Heuristic match: "}hjmx-eu.mail.am0.yahoodns.net" Heuristic match: "jmta6.am0.yahoodns.net" Heuristic match: ";shw-central.mx.a.cloudfilter.net" Heuristic match: "mx.sh" Heuristic match: "5mx3.vodafonemail.de" Heuristic match: "nivali-br.mail.protection.outlook.com" Heuristic match: "x.bt.prod.cloud.openwave.ai" Heuristic match: "arter.net" Heuristic match: "kvw-mx.msg.pkvw.co.charter.net" Heuristic match: "x2.free.fr" Heuristic match: "ok.com" Heuristic match: "ampabay.rr.com" Heuristic match: "x2.cgocable.ca" Heuristic match: "x-rogers.mail.am0.yahoodns.net" Heuristic match: "yahoodns.net" Heuristic match: "omcast.net" Heuristic match: "mx.abv.bg" Heuristic match: "xw.mxhichina.com" Heuristic match: "c.rr.com" Heuristic match: "fsmax.docomo.ne.jp" Heuristic match: "x02.p.bluenet.ch" Heuristic match: "x-aol.mail.gm0.yahoodns.net" Heuristic match: "utulsa-edu.mail.protection.outlook.com" Heuristic match: "sv.softbank.ne.jp" Heuristic match: "virginmedia.co" Heuristic match: "anadoo.fr" Heuristic match: "mtp-in.virgilio.it" Heuristic match: "am.olc.protection.outlook.com" Heuristic match: "a03.web.de" Heuristic match: "nge.fr" Heuristic match: "163mx00..net" Heuristic match: ".am0.yahoodns.163mx01.mxmail.netease.com" Heuristic match: "gefa1.gostec.com" Heuristic match: "x03.t-online.de" Heuristic match: "xmta.bellnet.ca" Heuristic match: "2.web.de" Heuristic match: "mx3.naver.com" Heuristic match: "mx2.naver.com" Heuristic match: "mx1.naver.com" Heuristic match: "mx6.mail.naver.com" Heuristic match: "mx5.mail.naver.com" Heuristic match: "ulsa-edu.mail.protection.outlook.com" Heuristic match: "3mx01.mx" Heuristic match: "a-com.mail.protection.outlook.com" Heuristic match: "aspmx2.googlemail.com" Heuristic match: "1.comcast.net" Heuristic match: "*:mx2.free.fr" Heuristic match: "!dmx2.cgocable.ca" Heuristic match: "`lmta6.am0.yahoodns.net" Heuristic match: "jmx-rogers.mail.am0.yahoodns.net" Heuristic match: "gmsv.softbank.ne.jp" Heuristic match: "`\mx-aol.mail.gm0.yahoodns.net" Heuristic match: "pmx-aol.mail.gm0.yahoodns.net" Heuristic match: "smtp-in.orange.fr" Heuristic match: "imx03.t-online.de"3b:T167f,GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com GET /3/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190 GET /3/18366.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190 GET /REST/v1/Imagery/Map/roadondemandfull/40.751 -73.964/5?mapSize=268 136&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|lv:1_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US HTTP/2 Host: ecn.dev.virtualearth.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /REST/v1/Imagery/Map/roadondemandfull/40.780 -73.970/5?mapSize=268 136&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|lv:1_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US HTTP/2 Host: ecn.dev.virtualearth.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: u=1 i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /mouse-gesture/config.json HTTP/2 Host: edge-consumer-static.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-Os: Windows Priority: u=4 i Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Accept-Encoding: gzip deflate br zstd Sec-Mesh-Client-Os-Version: 10.0.16299 Sec-Mesh-Client-Webview: 0 Sec-Fetch-Dest: empty GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /mapuid?member=280&user=32DFF8A43A9F6A9B15B5EE573B1A6B37;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D32DFF8A43A9F6A9B15B5EE573B1A6B37%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image 3c:T1c63,Contains base62 string in header "ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyT" in header "GET /REST/v1/Imagery/Map/roadondemandfull/40.751,-73.964/5?mapSize=268,136&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|lv:1_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US HTTP/2Host: ecn.dev.virtualearth.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyT" in header "GET /REST/v1/Imagery/Map/roadondemandfull/40.780,-73.970/5?mapSize=268,136&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|lv:1_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US HTTP/2Host: ecn.dev.virtualearth.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9M" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzG" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "32DFF8A43A9F6A9B15B5EE573B1A6B37;" in header "GET /mapuid?member=280&user=32DFF8A43A9F6A9B15B5EE573B1A6B37;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D32DFF8A43A9F6A9B15B5EE573B1A6B37%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "253D32DFF8A43A9F6A9B15B5EE573B1A6" in header "GET /mapuid?member=280&user=32DFF8A43A9F6A9B15B5EE573B1A6B37;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D32DFF8A43A9F6A9B15B5EE573B1A6B37%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image"3d:T529,Contacted domain: "ecn.dev.virtualearth.net" has high entropy Contacted domain: "px.ads.linkedin.com" has high entropy Contacted domain: "clients2.googleusercontent.com" has high entropy Contacted domain: "126mx00.mxmail.netease.com" has high entropy Contacted domain: "163mx03.mxmail.netease.com" has high entropy Contacted domain: "alt1.aspmx.l.google.com" has high entropy Contacted domain: "alt2.aspmx.l.google.com" has high entropy Contacted domain: "amx2.xworks.net" has high entropy Contacted domain: "aspmx3.googlemail.com" has high entropy Contacted domain: "bigpond.com.au" has high entropy Contacted domain: "bigpond.net.au" has high entropy Contacted domain: "blueyonder.co.uk" has high entropy Contacted domain: "btopenworld.com" has high entropy Contacted domain: "chimneyrockpark.com" has high entropy Contacted domain: "d216455.a.ess.uk.barracudanetworks.com" has high entropy Contacted domain: "dnvrco-postmx01.email.rr.com" has high entropy Contacted domain: "extmail.bigpond.com" has high entropy Contacted domain: "extmail.bpbb.bigpond.com" has high entropy Contacted domain: "innovapresse.com" has high entropy Contacted domain: "kempstoncontrols.co.uk" has high entropy Contacted domain: "mail.protonmail.ch" has high entropy Contacted domain: "mail15.komsa.de" has high entropy3e:T6be,Found HTTPS GET request to https://ecn.dev.virtualearth.net/REST/v1/Imagery/Map/roadondemandfull/40.751 -73.964/5?mapSize=268 136&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|lv:1_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US Found HTTPS GET request to https://ecn.dev.virtualearth.net/REST/v1/Imagery/Map/roadondemandfull/40.780 -73.970/5?mapSize=268 136&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|lv:1_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US Found HTTPS GET request to https://edge-consumer-static.azureedge.net/mouse-gesture/config.json Found HTTPS GET request to https://px.ads.linkedin.com/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= Found HTTPS GET request to https://clients2.googleusercontent.com/crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx Found HTTPS GET request to https://trc.taboola.com/sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= Found HTTPS GET request to https://m.adnxs.com/mapuid?member=280&user=32DFF8A43A9F6A9B15B5EE573B1A6B37;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D32DFF8A43A9F6A9B15B5EE573B1A6B37%2526gdpr%253D0%2526gdpr_consent%253D3f:Tac3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001196.00000000.134021.02D90000.00000004.mdmp, 00000000-00001196.00000001.135942.02D90000.00000004.mdmp, 00000000-00001196.00000002.137861.02D90000.00000004.mdmp, 00000000-00001196.00000003.143371.02D90000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001196.00000000.134021.02D90000.00000004.mdmp, 00000000-00001196.00000001.135942.02D90000.00000004.mdmp, 00000000-00001196.00000002.137861.02D90000.00000004.mdmp, 00000000-00001196.00000003.143371.02D90000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001196.00000000.134021.02D90000.00000004.mdmp, 00000000-00001196.00000001.135942.02D90000.00000004.mdmp, 00000000-00001196.00000002.137861.02D90000.00000004.mdmp, 00000000-00001196.00000003.143371.02D90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001196.00000000.134021.02D90000.00000004.mdmp, 00000000-00001196.00000001.135942.02D90000.00000004.mdmp, 00000000-00001196.00000002.137861.02D90000.00000004.mdmp, 00000000-00001196.00000003.143371.02D90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001196.00000000.134021.02D90000.00000004.mdmp, 00000000-00001196.00000001.135942.02D90000.00000004.mdmp, 00000000-00001196.00000002.137861.02D90000.00000004.mdmp, 00000000-00001196.00000003.143371.02D90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001196.00000000.134021.02D90000.00000004.mdmp, 00000000-00001196.00000001.135942.02D90000.00000004.mdmp, 00000000-00001196.00000002.137861.02D90000.00000004.mdmp, 00000000-00001196.00000003.143371.02D90000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001196.00000000.134021.02D90000.00000004.mdmp, 00000000-00001196.00000001.135942.02D90000.00000004.mdmp, 00000000-00001196.00000002.137861.02D90000.00000004.mdmp, 00000000-00001196.00000003.143371.02D90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001196.00000000.134021.02D90000.00000004.mdmp, 00000000-00001196.00000001.135942.02D90000.00000004.mdmp, 00000000-00001196.00000002.137861.02D90000.00000004.mdmp, 00000000-00001196.00000003.143371.02D90000.00000004.mdmp")40:T9b8,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001196.00000000.134021.02D90000.00000004.mdmp, 00000000-00001196.00000001.135942.02D90000.00000004.mdmp, 00000000-00001196.00000002.137861.02D90000.00000004.mdmp, 00000000-00001196.00000003.143371.02D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69f9e0194d0d8593ed0091d1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69f9e0194d0d8593ed0091d1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00001196.00000000.134021.02D90000.00000004.mdmp, 00000000-00001196.00000001.135942.02D90000.00000004.mdmp, 00000000-00001196.00000002.137861.02D90000.00000004.mdmp, 00000000-00001196.00000003.143371.02D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69f9e0194d0d8593ed0091d1"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69f9e0194d0d8593ed0091d1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"