26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T504,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Shellcode.Donut.Marte..Generic Sample f4b5090b1cdb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f4b5090b1cdb…. Malware family: Shellcode.Donut.Marte..Generic. Threat score 100/100. 14/28 AV engines flagged this file. 9 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","keywords":["Malicious","Shellcode.Donut.Marte..Generic","malware analysis","sandbox report","threat intelligence","f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079"],"about":{"@type":"SoftwareApplication","name":"f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","applicationCategory":["peexe","64bits","executable"],"identifier":"f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Shellcode.Donut.Marte..Generic","antivirusDetections":{"malicious":14,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T706,Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp, 00000000-00002688.00000000.161332.7B2B4000.00000002.mdmp, 00000000-00002688.00000000.161332.7B375000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp, 00000000-00002688.00000000.161332.7B2B4000.00000002.mdmp, 00000000-00002688.00000000.161332.7B375000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "__crtFreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002688.00000000.161332.7B2B4000.00000002.mdmp")28:T67a,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp")29:T83a,"runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\83DA05A9886F7658BE73ACF0A4930C0F99B92F01") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "runner_rem.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "runner_rem.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "runner_rem.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "runner_rem.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "runner_rem.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")2a:T692,"runner_rem.exe" queried SystemProcessInformation at 00000000-00007828-00000C15-940620163 [PID: 7828] "runner_rem.exe" queried SystemProcessInformation at 00000000-00007828-00000C15-940627891 [PID: 7828] "runner_rem.exe" queried SystemProcessInformation at 00000000-00007828-00000C15-940862638 [PID: 7828] "runner_rem.exe" queried SystemProcessInformation at 00000000-00007828-00000C15-940869934 [PID: 7828] "runner_rem.exe" queried SystemProcessInformation at 00000000-00007828-00000C15-941279314 [PID: 7828] "runner_rem.exe" queried SystemProcessInformation at 00000000-00007828-00000C15-941287151 [PID: 7828] "runner_rem.exe" queried SystemProcessInformation at 00000000-00007828-00000C15-941473726 [PID: 7828] "runner_rem.exe" queried SystemProcessInformation at 00000000-00007828-00000C15-941481854 [PID: 7828] "runner_rem.exe" queried SystemProcessInformation at 00000000-00007828-00000C15-941735907 [PID: 7828] "runner_rem.exe" queried SystemProcessInformation at 00000000-00007828-00000C15-941744227 [PID: 7828] "identity_helper.exe" queried SystemProcessInformation at 00000000-00002688-00000C15-1079164342 [PID: 2688] "identity_helper.exe" queried SystemProcessInformation at 00000000-00002688-00000C15-1079173230 [PID: 2688] "identity_helper.exe" queried SystemProcessInformation at 00000000-00002688-00000C15-1079363915 [PID: 2688] "identity_helper.exe" queried SystemProcessInformation at 00000000-00002688-00000C15-1079371585 [PID: 2688] "identity_helper.exe" queried SystemProcessInformation at 00000000-00002688-00000C15-1080692208 [PID: 2688] "identity_helper.exe" queried SystemProcessInformation at 00000000-00002688-00000C15-1080700386 [PID: 2688]2b:Teb3c,Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 136Host: rpc.mevblocker.io" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 136Host: rpc.mevblocker.io" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 136Host: rpc.mevblocker.io" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 136Host: rpc.mevblocker.io" Contains base64 string in header "application/jsonUser" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 136Host: rpc.mevblocker.io" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 136Host: rpc.mevblocker.io" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "/favicon" in header "GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "webp" in header "GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "services" in header "GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "bingapis" in header "GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "/favicon" in header "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "webp" in header "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "services" in header "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "bingapis" in header "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "/favicon" in header "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "webp" in header "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "services" in header "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "bingapis" in header "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "/favicon" in header "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "webp" in header "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "services" in header "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "bingapis" in header "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "/favicon" in header "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "webp" in header "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "services" in header "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "bingapis" in header "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "like" in header "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "0Sec" in header "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Mode" in header "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Site" in header "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Language" in header "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "8Sec" in header "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Edge" in header "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Chromium" in header "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Platform" in header "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Encoding" in header "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "gzip" in header "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base64 string in header "Dest" in header "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2Host: services.bingapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image"2c:T442,Found XOR loop in file "sample.bin" at offset 76283; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 76944; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 112017; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 148355; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 122661; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 291126; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 307139; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 307355; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 72797; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 132412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 186874; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 295524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 318857; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 327680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 330849; code bytes = 80302d:T590,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "__crtGetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp")2e:T1657,"runner_rem.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000545bf87f0000c05dd000f3010000d8e97f1dbb0000000600000000000000c1dac084f87f000000000000000000000000000000000000c0e77f1dbb000000000000000000000010e77f1dbb00000070d3ce84f87f00000000000000000000f0d2ce84f87f00000800000000000000ca00000000000000000000000000000078e77f1dbb000000000000010000000030e77f1dbb0000000000000069002d00f8004683f87f000069006e002d0063006f00720065002d0000000000000000008029c084f87f00000100000065006100640073002d006c0031002d0031002d009399be84f87f00000000bd84f87f00000846c484f87f0000006bd000 (UID: 00000000-00007828) "runner_rem.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007828) "runner_rem.exe" called "RtlGetVersion" with parameter 240100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007828) "runner_rem.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000061d100f3010000010000000000000000000000000000000000000000000000007aa26ef87f00005029d000f3010000c47bbe84f87f00005029d000f301000000000000f87f0000b8df0000f30100000000000000000000a09ad000f301000078e97f21bb0000000c000d0000000000de83a26ef87f00000000000000000000f8009d6ef87f000050eb7f21bb0000004861d100f30100000000000000000000ee5bc084f87f000001000000f87f0000144cbe84f87f00005029d000f301000098e97f21bb0000000000000000000000c1dac084f87f00009648b74dbb000000f8009d6ef87f000048ee7f21bb00000025bd9f6ef87f0000e0e97f21 (UID: 00000000-00007828) "runner_rem.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000000000000000d075d100f30100001019c284f87f0000000000000000000000007583f87f00000000000000000000ee269582f87f0000070000000000000000ea7f21bb00000000ea7f21bb000000400ea382f87f000000007583f87f00007b635682f87f0000020000000000000000000000000000009200000000000000a004e583f87f0000f0e97f21bb000000bb5f9582f87f00000d000000f87f0000a004e583f87f000092000000000000000000000000000000a004e583f87f00001c5b9582f87f0000000000000000000092000000000000000d000000f87f00000d00000000000000aa00000000000000d2458683f87f0000a03a8b83 (UID: 00000000-00007828) "runner_rem.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007828) "identity_helper.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002688) "identity_helper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002688) "identity_helper.exe" called "RtlGetVersion" with parameter 240100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002688)2f:T933,"runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "DISPLAYNAME") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "DISPLAYNAME") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA"; Key: "DISPLAYNAME") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX"; Key: "DISPLAYNAME") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA"; Key: "DISPLAYNAME") "runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MITMPROXY 12.2.3")30:T50b,"runner_rem.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "runner_rem.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "runner_rem.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "runner_rem.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "runner_rem.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "runner_rem.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "runner_rem.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "runner_rem.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "runner_rem.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "runner_rem.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")31:Tac2,"runner_rem.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00007828) "runner_rem.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007828) "runner_rem.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007828) "runner_rem.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007828) "runner_rem.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007828) "runner_rem.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007828) "runner_rem.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007828) "runner_rem.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007828) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002688) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002688) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002688) "identity_helper.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002688) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002688) "identity_helper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002688) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002688) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002688) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002688) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00002688) "identity_helper.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Edge\Application\145.0.3800.58\msedge.dll (UID: 00000000-00002688) "identity_helper.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002688) "identity_helper.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002688) "identity_helper.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002688) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002688) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002688) "identity_helper.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002688)32:T2b18,"runner_rem.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007828) "runner_rem.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007828) "identity_helper.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter RtlGetDeviceFamilyInfoEnum (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter PrefetchVirtualMemory (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter ChromeMain (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00002688) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsGetStringRawBuffer (UID: 00000000-00002688)33:T418,Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "CreateFileFromAppW" (Indicator: "CreateFile"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "CreateFileVersionInfoWin" (Indicator: "CreateFile"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp")34:T1508,"SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "Software\" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp 00000000-00002688.00000000.161332.76370000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00002688.00000000.161332.76370000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\AllFilesystemObjects" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Drive\shellex\FolderExtensions" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{B3F72108-5C5C-469B-A5E5-3F64D2A39B01}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{9ED07B24-36FD-543B-948E-B01FE5814B49}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D81E96F1-A89C-417E-9335-59531026309D}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "S-1-5-21-735145574-3570218355-1207367261-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "EDGE_USER_DATA_DIR=C:\Users\HAPUBWS\AppData\Loca\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}KTOP-FVV" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "EDGE_METRICS\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "PATHEXT=.COM;.\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp35:T8ec,Process runner_rem.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7828:304:WilStaging_02" Process runner_rem.exe created mutex with name "Local\SM0:7828:304:WilStaging_02" Process runner_rem.exe created mutex with name "SM0:7828:120:WilError_03" Process runner_rem.exe created mutex with name "SM0:7828:304:WilStaging_02" Process runner_rem.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7828:304:WilStaging_02" Process runner_rem.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7828:120:WilError_03" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5880:120:WilError_03" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5880:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:5880:304:WilStaging_02" Process msedge.exe created mutex with name "__OMADM_NAMED_MUTEX__" Process msedge.exe created mutex with name "Local\SM0:5880:120:WilError_03" Process msedge.exe created mutex with name "3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD" Process msedge.exe created mutex with name "SM0:5880:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:5880:120:WilError_03" Process msedge.exe created mutex with name "Local\SessionImmersiveColorMutex" Process msedge.exe created mutex with name "ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5880:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\__OMADM_NAMED_MUTEX__" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5880:120:WilError_03" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8148:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:8148:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:8148:304:WilStaging_02"36:T1bf9,"SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "Software\" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002688.00000000.161332.76370000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00002688.00000000.161332.76370000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\AllFilesystemObjects" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Drive\shellex\FolderExtensions" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{B3F72108-5C5C-469B-A5E5-3F64D2A39B01}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{9ED07B24-36FD-543B-948E-B01FE5814B49}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D81E96F1-A89C-417E-9335-59531026309D}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "S-1-5-21-735145574-3570218355-1207367261-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "EDGE_USER_DATA_DIR=C:\Users\HAPUBWS\AppData\Loca\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}KTOP-FVV" in Source: 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "EDGE_METRICS\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "PATHEXT=.COM;.\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp "y\Machine\Software\Classes\AppID\runner_rem.exe" in Source: 00000000-00007828.00000000.152473.00CF0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2" in Source: 00000000-00007828.00000000.152473.00CF0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007828.00000000.152473.00CF0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007828.00000000.152473.00CF0000.00000004.mdmp "y\Machine\Software\Classes\AppID\runner_rem.exe" in Source: 00000000-00007828.00000001.154395.00CF0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2" in Source: 00000000-00007828.00000001.154395.00CF0000.00000004.mdmp "y\Machine\Software\Classes\AppID\runner_rem.exe" in Source: 00000000-00007828.00000002.156313.00CF0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2" in Source: 00000000-00007828.00000002.156313.00CF0000.00000004.mdmp "y\Machine\Software\Classes\AppID\runner_rem.exe" in Source: 00000000-00007828.00000003.160475.00CF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008144.00000000.161007.76370000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00008144.00000000.161007.76370000.00000002.mdmp37:T1b69,"GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Sun 01 Nov 2026 12:14:57 GMT X-Msedge-Ref: Ref A: 3420AF34193D43F0A44F9D33DF52B9DE Ref B: BY1AA1072317034 Ref C: 2026-11-01T12:14:57Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 3420AF34193D43F0A44F9D33DF52B9DE Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS000006_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-Q9NPR Ref C: 2026-11-01T12:14:57Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Sun 01 Nov 2026 12:14:57 GMT X-Msedge-Ref: Ref A: A97B996AFE2B4D29931E8E929A2F3F25 Ref B: BY1AA1072317034 Ref C: 2026-11-01T12:14:58Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: A97B996AFE2B4D29931E8E929A2F3F25 Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS000015_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-NFS4N Ref C: 2026-11-01T12:14:58Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Sun 01 Nov 2026 12:14:57 GMT X-Msedge-Ref: Ref A: 07024BAFD733495CA76647F069AF0687 Ref B: BY1AA1072317034 Ref C: 2026-11-01T12:14:58Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 07024BAFD733495CA76647F069AF0687 Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS00000A_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-G4QM2 Ref C: 2026-11-01T12:14:58Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/svg+xml Date: Sun 01 Nov 2026 12:14:58 GMT X-Msedge-Ref: Ref A: EA0BEB80912A4F3F96820A736AC9CC0F Ref B: BY1AA1072317034 Ref C: 2026-11-01T12:14:59Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: EA0BEB80912A4F3F96820A736AC9CC0F Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS000006_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-Q9NPR Ref C: 2026-11-01T12:14:59Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>3C73766720786D6C6E733D22687474703A2F2F7777772E77332E6F72672F323030302F737667222076696577426F783D22302030203130302031303022207769....... "GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Sun 01 Nov 2026 12:14:58 GMT X-Msedge-Ref: Ref A: 81C15DFB22314DEDBA58402F6E608EEC Ref B: BY1AA1072317034 Ref C: 2026-11-01T12:14:59Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 81C15DFB22314DEDBA58402F6E608EEC Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS000015_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-NFS4N Ref C: 2026-11-01T12:14:59Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT.......38:T192b,"runner_rem.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff85b540000 "runner_rem.exe" loaded module "WININET.DLL" at base 7ff86fa50000 "runner_rem.exe" loaded module "MSCOREE.DLL" at base 7ff86e9d0000 "runner_rem.exe" loaded module "SHELL32.DLL" at base 7ff883750000 "runner_rem.exe" loaded module "WINHTTP.DLL" at base 7ff87c660000 "runner_rem.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff87fc00000 "runner_rem.exe" loaded module "RPCRT4.DLL" at base 7ff882bf0000 "runner_rem.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff882520000 "runner_rem.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8742f0000 "runner_rem.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff873c90000 "runner_rem.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff882520000 "runner_rem.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff882520000 "runner_rem.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff873cb0000 "runner_rem.exe" loaded module "AMSI.DLL" at base 7ff873590000 "runner_rem.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff882520000 "runner_rem.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff882520000 "runner_rem.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff882520000 "runner_rem.exe" loaded module "KERNEL32" at base 7ff884610000 "runner_rem.exe" loaded module "%WINDIR%\SYSTEM32\9L1Z74C7.DLL" at base 7ff87b6a0000 "runner_rem.exe" loaded module "SSPICLI.DLL" at base 7ff8820f0000 "runner_rem.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff866500000 "runner_rem.exe" loaded module "KERNEL32.DLL" at base 7ff884610000 "runner_rem.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff881910000 "runner_rem.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff878ae0000 "runner_rem.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff879e50000 "runner_rem.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff881140000 "runner_rem.exe" loaded module "MSKEYPROTECT.DLL" at base 7ff873430000 "runner_rem.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff8700c0000 "runner_rem.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 1f3029b0000 "runner_rem.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff881230000 "identity_helper.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff86d9d0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff882520000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff882520000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ff882520000 "identity_helper.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ff882b30000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff882520000 "identity_helper.exe" loaded module "KERNEL32" at base 7ff884610000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff882520000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff882520000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff882520000 "identity_helper.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 7ff884850000 "identity_helper.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGE\APPLICATION\145.0.3800.58\MSEDGE.DLL" at base 7ff83a7c0000 "identity_helper.exe" loaded module "ADVAPI32.DLL" at base 7ff883340000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff87fc00000 "identity_helper.exe" loaded module "USER32.DLL" at base 7ff883fb0000 "identity_helper.exe" loaded module "SHELL32.DLL" at base 7ff883750000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff882d10000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff882d10000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\EXECMODELCLIENT.DLL" at base 7ff86b4a0000 "identity_helper.exe" loaded module "RPCRT4.DLL" at base 7ff882bf0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff882d10000 "identity_helper.exe" loaded module "OLE32.DLL" at base 7ff883070000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.APPCORE.DLL" at base 7ff87c450000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WPNAPPS.DLL" at base 7ff869160000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 7ff86f210000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\EXECMODELPROXY.DLL" at base 7ff86a890000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ff87b8d0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ff86e6f0000 "identity_helper.exe" loaded module "NTDLL.DLL" at base 7ff884bd0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\BIWINRT.DLL" at base 7ff864ae0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ff87db90000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.APPLICATIONMODEL.DLL" at base 7ff86bcf0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff882b30000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTOWINRT.DLL" at base 7ff86f1a0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\TILEDATAREPOSITORY.DLL" at base 7ff8699f0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\USERMGRPROXY.DLL" at base 7ff878bf0000 "identity_helper.exe" loaded module "GDI32.DLL" at base 7ff8845d0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.INTERNAL.SHELL.BROKER.DLL" at base 7ff864830000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\PCSHELLCOMMONPROXYSTUB.DLL" at base 7ff866520000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\STARTTILEDATA.DLL" at base 7ff869330000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.APPLICATIONDATA.DLL" at base 7ff864e40000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff87ce40000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff8802f000039:T62f,"runner_rem.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "runner_rem.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "runner_rem.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "runner_rem.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "runner_rem.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "identity_helper.exe" touched "Windows Search Manager" (Path: "HKCU\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\TREATAS") "identity_helper.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "identity_helper.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "identity_helper.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "identity_helper.exe" touched "Property System Apartment Class Factory" (Path: "HKCU\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}\TREATAS") "identity_helper.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "identity_helper.exe" touched "Windows Push Notification Developer Proxy Stub" (Path: "HKCU\CLSID\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}\TREATAS")3a:Tbd6,Process "msedge.exe" (UID: 00000000-00005880) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "msedge.exe" (UID: 00000000-00005880) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00008148) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_5880_TNDMKQOLVCNZLISB", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="5880"" Process "msedge.exe" (UID: 00000000-00003616) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="12", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00001044) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "identity_helper.exe" (UID: 00000000-00008144) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="12", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="%OSUSER%", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", NODE_PATH="%PROGRAMFILES%\nodejs\node_modules", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", OS="Windows_NT", COMPUTERNAME="DESKTOP-FVVF82A", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753""3b:T72a,Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00005880) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00008148), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003616), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00005016), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00001044), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00006456), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00001624), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00008976), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00007204), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00008144), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00002688), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00000724), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00008096)3c:T72a,Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00005880) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00008148), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003616), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00005016), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00001044), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00006456), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00001624), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00008976), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00007204), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00008144), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00002688), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00000724), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00008096)3d:Td8e,The input sample is signed with a certificate issued by "CN=YE2, O=Let's Encrypt, C=US" (SHA1: 3F:89:D9:D0:EB:3E:15:5A:99:7A:89:03:69:40:7E:F7:82:DB:3B:22; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: F8:15:8C:A8:A3:A7:C5:DB:D7:84:22:18:F5:D9:49:CE:C8:3A:CD:BA; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 9C:FF:31:B5:1D:22:B9:BF:D3:80:8A:8C:35:B4:BB:DF:36:13:71:F0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: 27:E6:66:32:99:D3:40:DF:E5:45:71:CE:CC:EC:01:BE:74:49:5D:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: AA:BD:85:9A:77:31:8E:0D:DF:97:C7:57:71:23:D4:36:8D:B7:31:F5; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 07:BA:3F:43:71:52:C0:36:B4:98:D5:A6:CF:AF:23:B7:B6:8B:B5:90; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M04, O=Amazon, C=US" (SHA1: E7:26:0D:F0:1C:8D:4A:F7:5D:16:41:FB:C8:4E:3A:04:86:AD:99:8A; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon Root CA 1, O=Amazon, C=US" (SHA1: E7:B8:B5:A6:74:3C:E1:B2:F1:7B:04:1D:E5:95:58:A4:14:72:D7:0C; see report for more information) The input sample is signed with a certificate issued by "CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 06:B2:59:27:C4:2A:72:16:31:C1:EF:D9:43:1E:64:8F:A6:2E:1E:39; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 7E:9B:0B:64:0F:E9:7B:DD:92:F4:5A:F3:DF:89:50:51:E2:3F:3C:30; see report for more information)3e:T49e,Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp, 00000000-00002688.00000000.161332.7B2B4000.00000002.mdmp, 00000000-00002688.00000000.161332.7B375000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002688.00000000.161332.7B2B4000.00000002.mdmp")3f:T63a,"runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: ""; Value: "") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS\DNSCACHE"; Key: ""; Value: "") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: ""; Value: "") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES"; Key: ""; Value: "") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "runner_rem.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "")40:Tce2,"runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: "SECUREAUTOPROXY"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: "SENDDNSTOHOST"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "")41:T40e,"runner_rem.exe" trying to access non-existent file "C:\FLTLIB.DLL" "runner_rem.exe" trying to access non-existent file "C:\MSVCP140.dll" "runner_rem.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "runner_rem.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "runner_rem.exe" trying to access non-existent file "C:\wininet.dll" "runner_rem.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "runner_rem.exe" trying to access non-existent file "C:\mscoree.dll" "runner_rem.exe" trying to access non-existent file "C:\Windows\System32\wbem\wbemcomn.dll" "runner_rem.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "runner_rem.exe" trying to access non-existent file "C:\SspiCli.dll" "runner_rem.exe" trying to access non-existent file "C:\winnlsres.dll" "runner_rem.exe" trying to access non-existent file "C:\ncrypt.dll" "runner_rem.exe" trying to access non-existent file "C:\MSASN1.dll" "runner_rem.exe" trying to access non-existent file "C:\CRYPTBASE.dll"42:T8b6,"runner_rem.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1f300d5db10" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "tag=baa6b2d4b7616d0cd4cb575708d8d743&exp=1790902815&hwid=d28306033af45043094796539140d24b" "dwOptionalLength": "89" "dwTotalLength": "89" "dwContext": "0"} "runner_rem.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1f300d3b900" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "tag=baa6b2d4b7616d0cd4cb575708d8d743&exp=1790902815&hwid=d28306033af45043094796539140d24b" "dwOptionalLength": "89" "dwTotalLength": "89" "dwContext": "0"} "runner_rem.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1f300d8d520" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "tag=baa6b2d4b7616d0cd4cb575708d8d743&exp=1790902815&hwid=d28306033af45043094796539140d24b" "dwOptionalLength": "89" "dwTotalLength": "89" "dwContext": "0"} "runner_rem.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1f300cffd70" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "tag=baa6b2d4b7616d0cd4cb575708d8d743&exp=1790902815&hwid=d28306033af45043094796539140d24b" "dwOptionalLength": "89" "dwTotalLength": "89" "dwContext": "0"} "runner_rem.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1f300cffd70" "lpszHeaders": "Content-Type: application/json" "dwHeadersLength": "4294967295" "lpOptional": "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"0x999941b74F6bbc921D5174A5b29911562cd2D7CF\",\"data\":\"0xc2fb26a6\"},\"latest\"]}" "dwOptionalLength": "136" "dwTotalLength": "136" "dwContext": "0"} "runner_rem.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1f302b75f30" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "tag=baa6b2d4b7616d0cd4cb575708d8d743&exp=1790902815&hwid=d28306033af45043094796539140d24b" "dwOptionalLength": "89" "dwTotalLength": "89" "dwContext": "0"}43:T5a07,Found URL "https://www.office.comthumbnail" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2093703https://go.microsoft.com/fwlink/?linkid=2348603sites" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://support.google.com/chromebook?p=app_intent" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2118167" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/en-us/privacystatementyou're" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://aka.ms/edgepreviewhttps://aka.ms/enterprisepreviewuserto" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2149872an" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2165400to" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2165278https://go.microsoft.com/fwlink/?linkid=2348701https://go.microsoft.com/fwlink/?linkid=2165325https://go.microsoft.com/fwlink/?linkid=2348900use" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2239343https://go.microsoft.com/fwlink/?linkid=2288290show" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2301855allow" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2149000browsing" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2194724ai-powered" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/microsoft-edge/microsoft-edge-browsing-activity-for-personalized-advertising-and-experiences-37aa831e-6372-238e-f33f-7cd3f0e53679allow" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/microsoft-365/family-safetyhttps://family.microsoft.com/?ref=edge://settings/familysafetyhttps://go.microsoft.com/fwlink/?linkid=2127630set" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/account-billing/view-device-and-app-use-with-family-safety-activity-reporting-b7b8501e-e35c-2224-bed8-115d5da4fbafto" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/account-billing/filter-websites-and-searches-using-microsoft-family-safety-3034d91e-5efa-9fbe-1384-46009f087ccfto" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://microsoftedgetips.microsoft.com/en-us/internet" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2211966writing" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://support.microsoft.com/office/microsoft-editor-checks-grammar-and-more-in-documents-mail-and-the-web-91ecbe1b-d021-4e9e-a82e-abc4cd7163d7are" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=521839microsoft" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2279846see" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2166676learn" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://easylist.to/easylist/easylist.txtthe" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://easylist.to/index.htmlallow" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2181135adds" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2161865alerts" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://aka.ms/techscam-detection-learn-moreblock" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=529732manage" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2105403this" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2114187https://go.microsoft.com/fwlink/?linkid=2077327edit" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2121003when" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/servicesagreementmanage" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2101140change" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://aka.ms/accountsecuritylearn" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://aka.ms/synclearnmorelinkprofile" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/deployedge/edge-learnmore-reset-data-in-cloudreset" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2333202save" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2167671use" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://example.comsuper" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2257424keep" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/edge/features/real-time-video-translation?form=ma13fj&ch=1show" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://microsoft.com/en-us/edge/ai-powered/copilot-mode?form=ma140nhttps://microsoft.com/en-us/edge/ai-powered/copilot-mode?form=ma140mcopilot" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337798https://go.microsoft.com/fwlink/?linkid=2337885explore" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337628https://go.microsoft.com/fwlink/?linkid=2345959explore" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337721https://go.microsoft.com/fwlink/?linkid=2345869discover" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addons" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addonsno" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://aka.ms/edgeprintingtroubleshooting" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://aka.ms/printtroubleshootingneed" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2126235if" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://www.bing.com/new/termsofuseenhanceenhance" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://www.microsoft.com/edge/copilot-mode?form=mg0awropen" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/copilot/privacy-and-protections" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/microsoft-365-copilot/microsoft-365-copilot-privacy" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://aka.ms/whatisscarewarequick" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2107360&clcid=0x409hi," - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "http://force" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2164373" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2164373the" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addons?hl=enhttps://www.whatsapp.comhttps://www.facebook.comhttps://www.youtube.comhttps://www.outlook.com/allow" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2151738learn" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "http://example.com" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://example.com.your" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://support.google.com/chrome/a/answer/9122284" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "http://.

" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "http://," - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "http://example.com." - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/p/?linkid=2114059" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/p/\?linkid=158334https://support.microsoft.com/en-us/windows/microsoft-edge-" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/topic/protect-your-online-accounts-using-password-monitor-6f660aae-65aa-476c-871a-7fe2bcb0c4c1let's" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2193240check" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/en-us/privacystatement" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2189718protected" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/privacystatementalways" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "https://m365.cloud.microsoft/chat?fromcode=cmm63o75lj0let's" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "http://microsoft.com/edge/surfintroducing" - Source: "00000000-00002688.00000000.161332.D8AE0000.00000002.mdmp") Found URL "http://sparlink.click:7528/subscriptionssparlink.clicksparlink.clickdesktop-fvvf82a192.168.0.2desktop-fvvf82a192.168.0.2b+ncalrpc:[ole700acfb3ca534288e8bffd0207b8]t" - Source: "00000000-00007828.00000000.152473.00CF0000.00000004.mdmp") Found URL "http://sparlink.click:7528/subscriptionsa$" - Source: "00000000-00007828.00000000.152473.00CF0000.00000004.mdmp") Found URL "http://staphub.art:8531/contactsd\" - Source: "00000000-00007828.00000001.154395.00CF0000.00000004.mdmp") Found URL "http://staphub.art:8531/contacts29f229f2ub.aactsc9a9a595-328b-4c7f-8cd9-90b5b3c329f2" - Source: "00000000-00007828.00000001.154395.00CF0000.00000004.mdmp") Found URL "http://staphub.art:8531/contacts1001_classesdesktop-fvvf82ahapubwsy\machine\software\classes\appid\runner_rem.exe1001_classes\appid\runner_rem.exeesktop-fvvf82a\hapubws@%systemroot%\system32\mswsock.dll,-60100%systemroot%\system32\mswsock.dll@%systemroot%\system32\mswsock.dll,-60101%systemroot%\system32\mswsock.dll@%systemroot%\system32\mswsock.dll,-60102%systemroot%\system32\mswsock.dll@%systemroot%\system32\mswsock.dll,-60200%systemroot%\system32\mswsock.dll@%systemroot%\system32\mswsock.dll,-60201%systemroot%\system32\mswsock.dll@%systemroot%\system32\mswsock.dll,-60202%systemroot%\system32\mswsock.dllsystemroot%\system32\napinsp.dllvsockets" - Source: "00000000-00007828.00000002.156313.00CF0000.00000004.mdmp") Found URL "http://staphub.art:8531/contacts29f2" - Source: "00000000-00007828.00000002.156313.00D8A000.00000004.mdmp") Found URL "https://rpc.mevblocker.io/sfactorybuffersfactorybufferbem" - Source: "00000000-00007828.00000003.160475.00CF0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0'h8nwjm:sessrosophy\ppsmodulepath=c:\windows\system32\windowspowershell\v1.0\modules\;c:\program" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0'h8nwjm:s_," - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0'h8nwjm:lmem@3lssruuu" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0e" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "https://rpc.mevblocker.io/29f2assmcontent-typeapplication/jsonc329f2bdddbddd" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0'h8nwjm:lrpc-cfb982dcf152d7aaeb270517042126z0bl4ckyhills.com00yykcahbwv$_ntyebl4ckyhills.com*.bl4ckyhills.com:t" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobbhv*8tpa2.5.29.1digicert" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigicert" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eriss2.5.4.30" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm6oov>4httpx" - Source: "00000000-00007828.00000003.160475.00D36000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?verisign," - Source: "00000000-00007828.00000003.160475.02B20000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007828.00000003.160475.02B20000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007828.00000003.160475.02B20000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007828.00000003.160475.02B20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00007828.00000003.160475.02B20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00007828.00000003.160475.02B20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00007828.00000003.160475.02B20000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007828.00000003.160475.02B20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007828.00000003.160475.02B20000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007828.00000003.160475.02B20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007828.00000003.160475.02B20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007828.00000003.160475.02B20000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007828.00000003.160475.02B20000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0'h8nwjm:zfvache-controlinetzzzzhconzzzzhreqzzzz" - Source: "00000000-00007828.00000003.160475.02B20000.00000004.mdmp")44:Tcf7,GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image 45:T89a,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp, 00000000-00002688.00000000.161332.7B2B4000.00000002.mdmp, 00000000-00002688.00000000.161332.7B375000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp, 00000000-00002688.00000000.161332.7B2B4000.00000002.mdmp, 00000000-00002688.00000000.161332.7B375000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp, 00000000-00002688.00000000.161332.7B2B4000.00000002.mdmp") Found reference to API "__crtGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp") Found reference to API "__vcrt_GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002688.00000000.161332.7B2B4000.00000002.mdmp")46:Ta98,Found reference to API "GetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "GetFileAttributesExFromAppW" (Indicator: "GetFileAttributes"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp") Found reference to API "__crtGetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp")47:T553,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002688.00000000.161332.00054000.00000004.mdmp, 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp, 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp, 00000000-00002688.00000000.161332.D4D00000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002688.00000000.161332.00054000.00000004.mdmp, 00000000-00002688.00000000.161332.D4C78000.00000004.mdmp, 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp, 00000000-00002688.00000000.161332.D4D00000.00000004.mdmp") Found string "C:\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp") Found string "\Microsoft\PolicyManager\current\Device\Privacy" (Indicator: "\Device\"; Source: "00000000-00002688.00000000.161332.D4D00000.00000004.mdmp")48:T4d5,Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp")49:Tc8f,Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00002688.00000000.161332.65411000.00000002.mdmp")4a:Tae3,"runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "runner_rem.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "")4b:T6db,"POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 136 Host: rpc.mevblocker.io" with payload::==> "{"jsonrpc":"2.0","id":1,"method":"eth_call","params":[{"to":"0x999941b74F6bbc921D5174A5b29911562cd2D7CF","data":"0xc2fb26a6"},"latest"]}" HTTP/1.1 200 OK Date: Sun 01 Nov 2026 12:15:01 GMT Content-Type: application/json Content-Length: 230 Connection: keep-alive access-control-allow-origin: * vary: Origin x-info-build: 3.73.0 (2026-10-29T01:00:29Z) x-info-node: (f648547c-220d-49c6-8f00-c63720aa7517 - blb-v2-ethereum-mainnet-587658869b-69v5q) x-trace-id: 8af5e7900600ed05bda342e97ad3b6f0 Server: cloudflare cf-cache-status: DYNAMIC CF-RAY: a53ad290ab4672fa-SJC with response body ==>7B226A736F6E727063223A22322E30222C226964223A312C22726573756C74223A22307830303030303030303030303030303030303030303030303030303030....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded Host: github.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 89" with payload::==> "tag=baa6b2d4b7616d0cd4cb575708d8d743&exp=1790902815&hwid=d28306033af45043094796539140d24b" HTTP/1.1 403 Forbidden Server: cloudflare Date: Sun 01 Nov 2026 12:15:01 GMT Content-Type: text/html Content-Length: 553 Connection: keep-alive CF-RAY: a53ad2925b605f13-SJC with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E34303320466F7262696464656E3C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74.......4c:Tb61,"runner_rem.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "runner_rem.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "runner_rem.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "runner_rem.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "runner_rem.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "runner_rem.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "runner_rem.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "runner_rem.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "runner_rem.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "runner_rem.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "runner_rem.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "runner_rem.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "runner_rem.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "runner_rem.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "runner_rem.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "runner_rem.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "runner_rem.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "runner_rem.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "runner_rem.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "runner_rem.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "runner_rem.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "runner_rem.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "runner_rem.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "runner_rem.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "runner_rem.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793535518890,"unified_at":"2026-11-01T12:18:38.890Z","metadata":{"hashes":{"sha256":"f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","sha1":"9c88aad4c725467712815b48c995a72fa69c291f","md5":"f12078ac32c1e939e5daa6a49a09e443","sha512":"1f4aeddb0979a34e37b38115bc43984c71a6c6e5165bd441005b11695c86cbd0bd1badcc1f50f69174f250e933016a8d900f7fc11cc4580d7f1f940e69f13714","ssdeep":"6144:BptI3MtCRSKXGAF+DVv/n5ZycXiYwcsYBkyhdQ3d3gMWyjVX7JSi9ST4hUlU:/I7WjDtBImsY5u3dmY4iC4IU","ssdeep_chunks":["6144:BptI3Mt","6144:ptI3MtC","6144:tI3MtCR","6144:I3MtCRS","6144:3MtCRSK","6144:MtCRSKX","6144:tCRSKXG","6144:CRSKXGA","6144:RSKXGAF","6144:SKXGAF+","6144:KXGAF+D","6144:XGAF+DV","6144:GAF+DVv","6144:AF+DVv/","6144:F+DVv/n","6144:+DVv/n5","6144:DVv/n5Z","6144:Vv/n5Zy","6144:v/n5Zyc","6144:/n5ZycX","6144:n5ZycXi","6144:5ZycXiY","6144:ZycXiYw","6144:ycXiYwc","6144:cXiYwcs","6144:XiYwcsY","6144:iYwcsYB","6144:YwcsYBk","6144:wcsYBky","6144:csYBkyh","6144:sYBkyhd","6144:YBkyhdQ","6144:BkyhdQ3","6144:kyhdQ3d","6144:yhdQ3d3","6144:hdQ3d3g","6144:dQ3d3gM","6144:Q3d3gMW","6144:3d3gMWy","6144:d3gMWyj","6144:3gMWyjV","6144:gMWyjVX","6144:MWyjVX7","6144:WyjVX7J","6144:yjVX7JS","6144:jVX7JSi","6144:VX7JSi9","6144:X7JSi9S","6144:7JSi9ST","6144:JSi9ST4","6144:Si9ST4h","6144:i9ST4hU","6144:9ST4hUl","6144:ST4hUlU","12288:BptI3Mt","12288:ptI3MtC","12288:tI3MtCR","12288:I3MtCRS","12288:3MtCRSK","12288:MtCRSKX","12288:tCRSKXG","12288:CRSKXGA","12288:RSKXGAF","12288:SKXGAF+","12288:KXGAF+D","12288:XGAF+DV","12288:GAF+DVv","12288:AF+DVv/","12288:F+DVv/n","12288:+DVv/n5","12288:DVv/n5Z","12288:Vv/n5Zy","12288:v/n5Zyc","12288:/n5ZycX","12288:n5ZycXi","12288:5ZycXiY","12288:ZycXiYw","12288:ycXiYwc","12288:cXiYwcs","12288:XiYwcsY","12288:iYwcsYB","12288:YwcsYBk","12288:wcsYBky","12288:csYBkyh","12288:sYBkyhd","12288:YBkyhdQ","12288:BkyhdQ3","12288:kyhdQ3d","12288:yhdQ3d3","12288:hdQ3d3g","12288:dQ3d3gM","12288:Q3d3gMW","12288:3d3gMWy","12288:d3gMWyj","12288:3gMWyjV","12288:gMWyjVX","12288:MWyjVX7","12288:WyjVX7J","12288:yjVX7JS","12288:jVX7JSi","12288:VX7JSi9","12288:X7JSi9S","12288:7JSi9ST","12288:JSi9ST4","12288:Si9ST4h","12288:i9ST4hU","12288:9ST4hUl","12288:ST4hUlU","6144:/I7WjDt","6144:I7WjDtB","6144:7WjDtBI","6144:WjDtBIm","6144:jDtBIms","6144:DtBImsY","6144:tBImsY5","6144:BImsY5u","6144:ImsY5u3","6144:msY5u3d","6144:sY5u3dm","6144:Y5u3dmY","6144:5u3dmY4","6144:u3dmY4i","6144:3dmY4iC","6144:dmY4iC4","6144:mY4iC4I","6144:Y4iC4IU"],"imphash":"b8a6f94f6ddbd0872ad3843af22d24d5","pehash":"6db0c6074588d847e51aafad875cc7fa9b6e4b7a"},"file_info":{"file_name":"f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":374803,"entropy":7.84,"compile_timestamp":"1981-11-25T11:22:34","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791088092000,"last_seen":1793535132000,"last_multi_scan":1793535132000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":8,"import_count":0,"export_count":0,"embedded_file_count":2,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":44422,"raw_size":44544},{"name":".rdata","virtual_address":"0xc000","virtual_size":277604,"raw_size":278016},{"name":".buildid","virtual_address":"0x50000","virtual_size":28,"raw_size":512},{"name":".data","virtual_address":"0x51000","virtual_size":232,"raw_size":512},{"name":".pdata","virtual_address":"0x52000","virtual_size":660,"raw_size":1024},{"name":".tls","virtual_address":"0x53000","virtual_size":16,"raw_size":512},{"name":".rsrc","virtual_address":"0x54000","virtual_size":856,"raw_size":1024},{"name":".reloc","virtual_address":"0x55000","virtual_size":108,"raw_size":512}],"section_names":[".text",".rdata",".buildid",".data",".pdata",".tls",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["remusstealer","commodity","loader","donut","opensource","criminal","informationstealer","evasive","malicious","new_domain"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":2,"threat_actors_count":1,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":81},"sandbox_signatures":{"informative_count":167,"suspicious_count":10,"malicious_count":9,"total":186},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.AsyncRAT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win64.DonutInjector","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Agent.BEEM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Shellcode.Donut.Marte.!s!.D.253C7927","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Shellcode.Donut.Marte.!s!.D.253C7927 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/GenKryptik.HVPA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/Lotok.jy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 00584baa1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.QTDR-6928","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.GenKryptik.Win64.82088","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Shellcode.Donut.Marte..Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Donut","sources":[{"report_type":"qsp","report_id":""}]}],"threat_actors":[{"value":"QUILTED TIGER","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"malicious","value":"Recently registered domain detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Stealth","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"TlsGetValue\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"VirtualQuery\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"InitializeCriticalSection\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"VirtualProtect\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"Sleep\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"=>.su\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"DecompressionStream\" (Source: \"00000000-00002688.00000000.161332.D6F00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread failed\" (Indicator: \"ResumeThread\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$28","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA512 block transform for x86_64, CRYPTOGAMS by \" (Indicator: \"SHA512\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to \"Windows.Security.Cryptography.Core.HashAlgorithmProviderVVF\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00002688.00000000.161332.D4C78000.00000004.mdmp\")\n Found reference to \"Windows.Security.Cryptography.Core.HashAlgorithmProvider\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00002688.00000000.161332.D4C78000.00000004.mdmp\")\n Found reference to \"Windows.Security.Cryptography.Core.HashAlgorithmNames\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00002688.00000000.161332.D4C78000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - PE_NAME=\\\\.\\pi; Source: \"00000000-00002688.00000000.161332.D4D00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 76A00000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"runner_rem.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"runner_rem.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"msedge.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"fromCharCodeU\" (Indicator: \"fromcharcode\"; Source: \"00000000-00002688.00000000.161332.D6F00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.85091","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"github.com\" (Indicator: \"github.com\"; File: \"PCAP\")\n file/memory contains long string with (Indicator: \"github.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"::GetUserNameW\" (Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"Mojo.Channel.WriteSendMessageProcessType\" (Indicator: \"sendmessage\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"postMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00002688.00000000.161332.D6F00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"runner_rem.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007828)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"runner_rem.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007828)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"runner_rem.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007828)\n \"identity_helper.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002688)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"runner_rem.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"identity_helper.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp, 00000000-00002688.00000000.161332.7B2B4000.00000002.mdmp, 00000000-00002688.00000000.161332.7B375000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"runner_rem.exe\" queried token user identity (UID: 00000000-00007828)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"runner_rem.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"runner_rem.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$30","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$32","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"rpc.mevblocker.io\"\n \"github.com\"\n \"services.bingapis.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"23.254.202.107:7528\"\n \"143.244.190.5:5621\"\n \"159.89.166.50:8531\"\n \"65.8.27.58:443\"\n \"150.171.73.13:443\"\n \"104.18.10.61:443\"\n \"172.67.204.28:443\"\n \"142.250.65.65:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryAndGetError\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$34","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$35","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"runner_rem.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"\n Pattern match: \"r@uma.negativesamples.reason\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"YouTube\" (Indicator: \"youtube\"; File: \"screen_4.png\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - EDGE_CRASHPAD_PIPE_NAME=\\\\.\\pipe\\crashpad_5880_TNDMKQOLVCNZLISB\n Found string - \\\\.\\pipe\\LOCAL\\mojo.\n Found string - \\\\.\\pipe\\mojo.\n Found string - \\\\.\\pipe\\","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$36","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$37","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"msedge.exe\" (UID: 00000000-00005880)\n Launches browser \"msedge.exe\" (UID: 00000000-00008148)\n Launches browser \"msedge.exe\" (UID: 00000000-00003616)\n Launches browser \"msedge.exe\" (UID: 00000000-00005016)\n Launches browser \"msedge.exe\" (UID: 00000000-00001044)\n Launches browser \"msedge.exe\" (UID: 00000000-00006456)\n Launches browser \"msedge.exe\" (UID: 00000000-00001624)\n Launches browser \"msedge.exe\" (UID: 00000000-00008976)\n Launches browser \"msedge.exe\" (UID: 00000000-00007204)\n Launches browser \"msedge.exe\" (UID: 00000000-00000724)\n Launches browser \"msedge.exe\" (UID: 00000000-00008096)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"runner_rem.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 73590000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"runner_rem.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 822E0000\n \"runner_rem.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 029B0000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 822E0000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 82B30000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"runner_rem.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 82BF0000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 82BF0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a37082f87f0000@ntdll.dll\"\n \"220023000000000038a37082f87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"runner_rem.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$39","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"runner_rem.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"runner_rem.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"runner_rem.exe\" has an writable section named \".data\"\n \"runner_rem.exe\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"runner_rem.exe\" file has an entrypoint instructions - \"push\trbp,sub\trsp, 0x20,lea\trbp, [rsp + 0x20],mov\trax, qword ptr [rip + 0x4a043],mov\tdword ptr [rax], 1,call\t0x140002339,nop\t,nop\t,nop\t,add\trsp, 0x20,pop\trbp,ret\t,push\trbp,push\tr15,push\tr14,push\tr12,push\trsi,push\trdi,push\trbx,sub\trsp, 0x20,lea\trbp, [rsp + 0x20],mov\teax, 0x30,mov\trax, qword ptr gs:[eax],mov\trdi, qword ptr [rax + 8],mov\trsi, qword ptr [rip + 0x4a02f],xor\teax, eax,lock cmpxchg\tqword ptr [rsi], rdi,sete\tbl,cmp\trdi, rax,sete\tal,or\tal, bl,jne\t0x140002395,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"runner_rem.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"bl4ckyhills.com\"\n \"clients2.googleusercontent.com\"\n \"edge-consumer-static.azureedge.net\"\n \"github.com\"\n \"r.msftstatic.com\"\n \"rpc.mevblocker.io\"\n \"sb.scorecardresearch.com\"\n \"services.bingapis.com\"\n \"sparlink.click\"\n \"staphub.art\"\n \"visnary.my\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"runner_rem.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"runner_rem.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"runner_rem.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"runner_rem.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$3c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$3d","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"runner_rem.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"identity_helper.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"runner_rem.exe\" queries basic process information of the \"C:\\runner_rem.exe\" (UID: 7828)\n \"identity_helper.exe\" queries basic process information of the \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe\" (UID: 2688)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"runner_rem.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007828)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"runner_rem.exe\" reads file \"c:\\runner_rem.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"runner_rem.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"runner_rem.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"runner_rem.exe\" trying to touch file \"C:\\runner_rem.exe\"\n \"runner_rem.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"runner_rem.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"runner_rem.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"runner_rem.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"runner_rem.exe\" trying to touch file \"C:\\Windows\\System32\\ucrtbase.dll\"\n \"runner_rem.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"runner_rem.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"runner_rem.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"runner_rem.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"runner_rem.exe\" trying to access non-existent file \"\\Device\\RasAcd\"\n \"identity_helper.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\LocalState\\ToastCollectionIcons\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$42","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"runner_rem.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1f300d5db10\"\n \"lpReserved\": \"0\"\n \"$error\": \"2f78\"}\n \"runner_rem.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1f300d3b900\"\n \"lpReserved\": \"0\"\n \"$error\": \"2f78\"}\n \"runner_rem.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1f300d8d520\"\n \"lpReserved\": \"0\"\n \"$error\": \"2f78\"}\n \"runner_rem.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1f300cffd70\"\n \"lpReserved\": \"0\"\n \"$error\": \"2f78\"}\n \"runner_rem.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1f300cffd70\"\n \"lpReserved\": \"0\"}\n \"runner_rem.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1f302b75f30\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /\"\n Found http requests in header \"GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"GetNamedPipeClientProcessId\" (Indicator: \"GetNamedPipe\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"GetNamedPipeServerProcessId\" (Indicator: \"GetNamedPipe\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"0.0.0.0\" found in string \"0.0.0.0-devel\"\n \"192.168.0.2\"\n \"14.5.40.5\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$44","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"services.bingapis.com\" has high entropy\n Contacted domain: \"clients2.googleusercontent.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7\n Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"bl4ckyhills.com\" (6 days old)\n Newly renewed or created SSL certificate: \"r.msftstatic.com\" (4 days old)\n Newly renewed or created SSL certificate: \"sb.scorecardresearch.com\" (13 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://rpc.mevblocker.io/\n Found HTTPS POST request to https://github.com/\n Found HTTPS GET request to https://services.bingapis.com/favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t\n Found HTTPS GET request to https://services.bingapis.com/favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t\n Found HTTPS GET request to https://services.bingapis.com/favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t\n Found HTTPS GET request to https://services.bingapis.com/favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t\n Found HTTPS GET request to https://services.bingapis.com/favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"bl4ckyhills.com\" (89 days old)\n Short term registered certificate: \"rpc.mevblocker.io\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"65.8.27.58\" on port \"443\"\n HTTPS traffic to \"150.171.73.13\" on port \"443\"\n HTTPS traffic to \"104.18.10.61\" on port \"443\"\n HTTPS traffic to \"172.67.204.28\" on port \"443\"\n HTTPS traffic to \"142.250.65.65\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"::WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"F+ncalrpc:[OLEAB38C31E555EBAF325E2C9249073]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002688.00000000.161332.D4C78000.00000004.mdmp, 00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE9FFB37F05D518F76BEA9D1119EBD]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002688.00000000.161332.D4C78000.00000004.mdmp\")\n Found string \"\\REGISTRB+ncalrpc:[OLE30FC2200D4DC844681B41238825C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002688.00000000.161332.D4C78000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE30FC2200D4DC844681B41238825C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002688.00000000.161332.D4C78000.00000004.mdmp\")\n Found string \"F+ncalrpc:[OLEA89508C0466E87AE9E1F6D6FC6AB]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002688.00000000.161332.D4C78000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--profile-directory=Default\" (Indicator: \"--profile-directory=\"; File: \"msedge.exe\")\n Found string \"--user-data-dir=\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegEnumKeyExW\" in \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\"\n Found registry query API: \"NtQueryValueKey\" in \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00002688.00000000.161332.76370000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"::GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"::WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"NtQueryObject-type_info_length\" (Indicator: \"NtQueryObject\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"NtQueryObject\" (Indicator: \"NtQueryObject\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"runner_rem.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"identity_helper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"runner_rem.exe\" called \"GetComputerNameA\" (UID: 00000000-00007828)\n \"runner_rem.exe\" called \"GetComputerNameW\" (UID: 00000000-00007828)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"identity_helper.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"runner_rem.exe\" called \"GetUserNameA\" (UID: 00000000-00007828)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"Vector Permutation AES for x86_64/SSSE3, Mike Hamburg (Stanford University)\" (Indicator: \"aes\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found string \"AES for Intel AES-NI, CRYPTOGAMS by \" (Indicator: \"aes\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found string \"AES-NI GCM module for x86_64, CRYPTOGAMS by \" (Indicator: \"aes\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found string \"ChaCha20 for x86_64, CRYPTOGAMS by \" (Indicator: \"chacha\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found string \"SimdutfBase64Encode\" (Indicator: \"base64\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExFromAppW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"FindFirstFileEx\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp, 00000000-00002688.00000000.161332.7B2B4000.00000002.mdmp\")\n Found reference to API \"__vcrt_GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002688.00000000.161332.7B2B4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp, 00000000-00002688.00000000.161332.7B2B4000.00000002.mdmp, 00000000-00002688.00000000.161332.7B375000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp, 00000000-00002688.00000000.161332.7B2B4000.00000002.mdmp\")\n Found reference to API \"__vcrt_GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002688.00000000.161332.7B2B4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"__crtGetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password_manager.mojom.CSVPasswordParser\" (Indicator: \"password\"; Source: \"00000000-00002688.00000000.161332.00004000.00000004.mdmp\")\n Found string \"password_manager.breach_detection.mojom.EdgePasswordDataProcessor\" (Indicator: \"password\"; Source: \"00000000-00002688.00000000.161332.00054000.00000004.mdmp\")\n Found string \"passwords\" (Indicator: \"password\"; Source: \"00000000-00002688.00000000.161332.000BC000.00000004.mdmp, 00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found string \"password_manager\" (Indicator: \"password\"; Source: \"00000000-00002688.00000000.161332.000BC000.00000004.mdmp, 00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found string \"passwords/manual_filling_controller/0x?\" (Indicator: \"password\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\"\n Found registry deletion API: \"NtDeleteKey\" in \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\"\n Found registry deletion API: \"NtDeleteValueKey\" in \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$47","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileWithDispositionFlags\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"DoDeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"RemoveDirectory\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002688.00000000.161332.000BC000.00000004.mdmp\n 00000000-00002688.00000000.161332.65411000.00000002.mdmp\n 00000000-00002688.00000000.161332.76370000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002688.00000000.161332.65411000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.6DAC1000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp, 00000000-00002688.00000000.161332.7B2B4000.00000002.mdmp, 00000000-00002688.00000000.161332.7B375000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp, 00000000-00002688.00000000.161332.76370000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"runner_rem.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"runner_rem.exe\" opened \"\\Device\\KsecDD\"\n \"msedge.exe\" opened \"\\Device\\KsecDD\"\n \"identity_helper.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00002688.00000000.161332.D4CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002688.00000000.161332.65411000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".buildid\" has very low entropy (0.10)\n indicating potential NOP sled\n Section \".data\" has very low entropy (0.30)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"runner_rem.exe\" has section name .rdata with entropy \"7.9337309936691085\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\runner_rem.exe\" queried ProcessMitigationPolicy\n \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/27 Antivirus vendors marked sample as malicious (48% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$4b","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 142.250.65.65\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.18.10.61 on port 443 is sent without HTTP header\n TCP traffic to 172.67.204.28 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateThread\n Sleep\n VirtualAlloc\n VirtualProtect","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"runner_rem.exe\" claims program is from Wed Nov 25 11:22:34 1981","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"runner_rem.exe\" at 00000000-00007828-00000C15-942242746\n \"runner_rem.exe\" at 00000000-00007828-00000C15-942246716","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/27 Antivirus vendors marked sample as malicious (48% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 3)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"sparlink.click\" has been identified as malicious\n Contacted Domain: \"visnary.my\" has been identified as malicious\n Contacted Domain: \"staphub.art\" has been identified as malicious\n Contacted Domain: \"bl4ckyhills.com\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"malicious","category":"Network Related","name":"Recently registered domain detected","description":"Recently Registered domain detected: \"bl4ckyhills.com\" (6 days old). Commonly seen with phishing or other suspicious domains","origin":"Network Traffic","mitre_attack_id":"T1583.001","relevance":10,"id":"network-8601","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"\"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nHost: github.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\nContent-Length: 89\" with payload:==> \"tag=baa6b2d4b7616d0cd4cb575708d8d743&exp=1790902815&hwid=d28306033af45043094796539140d24b\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 11 domains and 11 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]}],"intel_graph":{"map":{"Domain:bl4ckyhills.com":{"type":"Domain","value":"bl4ckyhills.com"},"Domain:clients2.googleusercontent.com":{"type":"Domain","value":"clients2.googleusercontent.com"},"Domain:edge-consumer-static.azureedge.net":{"type":"Domain","value":"edge-consumer-static.azureedge.net"},"Domain:github.com":{"type":"Domain","value":"github.com"},"Domain:r.msftstatic.com":{"type":"Domain","value":"r.msftstatic.com"},"Domain:rpc.mevblocker.io":{"type":"Domain","value":"rpc.mevblocker.io"},"Domain:sb.scorecardresearch.com":{"type":"Domain","value":"sb.scorecardresearch.com"},"Domain:services.bingapis.com":{"type":"Domain","value":"services.bingapis.com"},"Domain:sparlink.click":{"type":"Domain","value":"sparlink.click"},"Domain:staphub.art":{"type":"Domain","value":"staphub.art"},"Domain:visnary.my":{"type":"Domain","value":"visnary.my"},"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079":{"type":"File","value":"f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat Donut"]}},"Ip:104.18.10.61":{"type":"Ip","value":"104.18.10.61"},"Ip:142.250.65.65":{"type":"Ip","value":"142.250.65.65"},"Ip:143.244.190.5":{"type":"Ip","value":"143.244.190.5"},"Ip:150.171.110.7":{"type":"Ip","value":"150.171.110.7"},"Ip:150.171.27.10":{"type":"Ip","value":"150.171.27.10"},"Ip:150.171.73.13":{"type":"Ip","value":"150.171.73.13"},"Ip:159.89.166.50":{"type":"Ip","value":"159.89.166.50"},"Ip:172.67.204.28":{"type":"Ip","value":"172.67.204.28"},"Ip:23.254.202.107":{"type":"Ip","value":"23.254.202.107"},"Ip:65.8.27.58":{"type":"Ip","value":"65.8.27.58"},"Threat:cf27745b0afa6d34e6b45fa1940ddef63982f5e01c71c093b871f0d6ffe6f14d":{"type":"Threat","value":"Donut","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Url:/":{"type":"Url","value":"/"},"Url:/favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t"}},"chains":[{"id":"1566424628935045445","root":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat Donut"]}},{"id":"1566424628935045444","root":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","edges":[{"edge_kind":"is_threat","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Threat:cf27745b0afa6d34e6b45fa1940ddef63982f5e01c71c093b871f0d6ffe6f14d"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","edges":[{"edge_kind":"contacted_ip","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Ip:23.254.202.107"},{"edge_kind":"contacted_ip","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Ip:143.244.190.5"},{"edge_kind":"contacted_ip","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Ip:159.89.166.50"},{"edge_kind":"contacted_ip","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Ip:65.8.27.58"},{"edge_kind":"contacted_ip","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Ip:150.171.73.13"},{"edge_kind":"contacted_ip","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Ip:104.18.10.61"},{"edge_kind":"contacted_ip","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Ip:172.67.204.28"},{"edge_kind":"contacted_ip","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Ip:142.250.65.65"},{"edge_kind":"contacted_domain","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Domain:bl4ckyhills.com"},{"edge_kind":"resolves_to","from_key":"Domain:bl4ckyhills.com","to_key":"Ip:172.67.204.28"},{"edge_kind":"contacted_domain","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Domain:clients2.googleusercontent.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.googleusercontent.com","to_key":"Ip:142.250.65.65"},{"edge_kind":"contacted_domain","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Domain:edge-consumer-static.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edge-consumer-static.azureedge.net","to_key":"Ip:150.171.110.7"},{"edge_kind":"contacted_domain","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Domain:github.com"},{"edge_kind":"contacted_domain","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Domain:r.msftstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:r.msftstatic.com","to_key":"Ip:150.171.27.10"},{"edge_kind":"contacted_domain","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Domain:rpc.mevblocker.io"},{"edge_kind":"resolves_to","from_key":"Domain:rpc.mevblocker.io","to_key":"Ip:104.18.10.61"},{"edge_kind":"contacted_domain","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Domain:sb.scorecardresearch.com"},{"edge_kind":"resolves_to","from_key":"Domain:sb.scorecardresearch.com","to_key":"Ip:65.8.27.58"},{"edge_kind":"contacted_domain","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Domain:services.bingapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:services.bingapis.com","to_key":"Ip:150.171.73.13"},{"edge_kind":"contacted_domain","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Domain:sparlink.click"},{"edge_kind":"resolves_to","from_key":"Domain:sparlink.click","to_key":"Ip:23.254.202.107"},{"edge_kind":"contacted_domain","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Domain:staphub.art"},{"edge_kind":"resolves_to","from_key":"Domain:staphub.art","to_key":"Ip:159.89.166.50"},{"edge_kind":"contacted_domain","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Domain:visnary.my"},{"edge_kind":"resolves_to","from_key":"Domain:visnary.my","to_key":"Ip:143.244.190.5"},{"edge_kind":"contacted_url","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Url:/"},{"edge_kind":"contacted_url","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Url:/favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Url:/favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Url:/favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Url:/favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","to_key":"Url:/favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":14,"spawned_processes_count":14,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":55,"imported_dlls_count":201,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":22,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":8,"dns_resolutions_count":11,"contacted_urls_count":6,"http_requests_count":6},"behavior_tags":["remusstealer","commodity","loader","donut","opensource","criminal","informationstealer","evasive","malicious","new_domain"],"sample_flags":["Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"6ae72c9b40981c3ea9010fb0","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Shellcode.Donut.Marte.","contacted_countries":["IND","USA"],"submit_name":"runner_rem.exe","analysis_start_time":"2026-11-01T12:12:13+00:00","indicators_count":{"informative":167,"suspicious":33,"malicious":7},"tags":["Multi-Process","Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"23.254.202.107","port":7528,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"address":"143.244.190.5","port":5621,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"address":"159.89.166.50","port":8531,"protocol":"TCP","country":"India","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"address":"65.8.27.58","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"address":"150.171.73.13","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"address":"104.18.10.61","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"address":"172.67.204.28","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"address":"142.250.65.65","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]}],"dns_resolutions":[{"domain":"bl4ckyhills.com","address":"172.67.204.28","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"domain":"clients2.googleusercontent.com","address":"142.250.65.65","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"domain":"edge-consumer-static.azureedge.net","address":"150.171.110.7","ttl":55,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"domain":"github.com","country":"-","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"domain":"r.msftstatic.com","address":"150.171.27.10","ttl":3401,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"domain":"rpc.mevblocker.io","address":"104.18.10.61","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"domain":"sb.scorecardresearch.com","address":"65.8.27.58","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"domain":"services.bingapis.com","address":"150.171.73.13","ttl":2383,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"domain":"sparlink.click","address":"23.254.202.107","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"domain":"staphub.art","address":"159.89.166.50","ttl":3611,"country":"India","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"domain":"visnary.my","address":"143.244.190.5","ttl":2594,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]}],"http_requests":[{"host":"rpc.mevblocker.io","host_ip":"104.18.10.61:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\nContent-Length: 136\nHost: rpc.mevblocker.io","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=wavebrowsernews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=sleepfoundation.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=scienceinsights.org?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=colorwaysports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"host":"services.bingapis.com","host_ip":"150.171.73.13:443","url":"/favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=1001rss.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}],"processes":[{"pid":7828,"ppid":0,"name":"runner_rem.exe","command_line":"","sha256":"f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079","normalized_path":"C:\\runner_rem.exe","uid":"00000000-00007828","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":5880,"ppid":0,"name":"msedge.exe","command_line":"--profile-directory=Default","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00005880","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":8148,"ppid":5880,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2ec,0x35c,0x7ff865500f18,0x7ff865500f24,0x7ff865500f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005880","uid":"00000000-00008148"},{"pid":3616,"ppid":5880,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1980,i,2506866879166285685,2845897220599916573,524288 --field-trial-handle=1964,i,8435855430165999678,15652393436989816783,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2320 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005880","uid":"00000000-00003616"},{"pid":5016,"ppid":5880,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1712,i,4501945610350472760,5287343476418669914,262144 --field-trial-handle=1964,i,8435855430165999678,15652393436989816783,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2108 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005880","uid":"00000000-00005016"},{"pid":1044,"ppid":5880,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2392,i,5488800254233306874,12812230060104968738,524288 --field-trial-handle=1964,i,8435855430165999678,15652393436989816783,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2916 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005880","uid":"00000000-00001044"},{"pid":6456,"ppid":5880,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1793533178910028 --launch-time-ticks=2496807228 --skip-read-main-dll --metrics-shmem-handle=3544,i,182820215040692326,14995049811571737956,2097152 --field-trial-handle=1964,i,8435855430165999678,15652393436989816783,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3684 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005880","uid":"00000000-00006456"},{"pid":1624,"ppid":5880,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1793533178910028 --launch-time-ticks=2496782355 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3528,i,13706911259298226467,5854305172177166415,2097152 --field-trial-handle=1964,i,8435855430165999678,15652393436989816783,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3532 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005880","uid":"00000000-00001624"},{"pid":8976,"ppid":5880,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=5276,i,17763787159211322370,8144130720489112759,524288 --field-trial-handle=1964,i,8435855430165999678,15652393436989816783,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3824 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005880","uid":"00000000-00008976"},{"pid":7204,"ppid":5880,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5316,i,10257865832409230973,1475059956477335961,524288 --field-trial-handle=1964,i,8435855430165999678,15652393436989816783,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3656 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005880","uid":"00000000-00007204"},{"pid":8144,"ppid":5880,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6432,i,15898489278327969886,12292436040161372694,524288 --field-trial-handle=1964,i,8435855430165999678,15652393436989816783,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=6448 /prefetch:8","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00005880","uid":"00000000-00008144"},{"pid":2688,"ppid":5880,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6432,i,15898489278327969886,12292436040161372694,524288 --field-trial-handle=1964,i,8435855430165999678,15652393436989816783,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=6448 /prefetch:8","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00005880","uid":"00000000-00002688"},{"pid":724,"ppid":5880,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=6828,i,1137428009188202310,7621772533754126467,524288 --field-trial-handle=1964,i,8435855430165999678,15652393436989816783,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5416 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005880","uid":"00000000-00000724"},{"pid":8096,"ppid":5880,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3840,i,8114333420347498495,2441712408301581814,524288 --field-trial-handle=1964,i,8435855430165999678,15652393436989816783,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3124 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005880","uid":"00000000-00008096"}],"all_imported_dlls":["uxtheme.dll","wkscli.dll","dhcpcsvc.dll","dusmapi.dll","Windows.StateRepository.dll","winnsi.dll","dnsapi.dll","msasn1.dll","mdmregistration.dll","secur32.dll","StateRepository.Core.dll","imm32.dll","shell32.dll","winmm.dll","dmcmnutils.dll","Windows.StateRepositoryCore.dll","vk_swiftshader.dll","oneauth.dll","kernel32.dll","KernelBase.dll","bcryptprimitives.dll","windows.storage.dll","msedge.dll","d3d11.dll","well_known_domains.dll","ntdll.dll","cryptbase.dll","WinTypes.dll","iertutil.dll","ShellCommonCommonProxyStub.dll","MicrosoftAccountWAMExtension.dll","TenantRestrictionsPlugin.dll","wlanapi.dll","oleaut32.dll","kernel.appcore.dll","webio.dll","dsreg.dll","dhcpcsvc6.dll","CoreMessaging.dll","StructuredQuery.dll","mfplat.dll","mscoree.dll","wbemsvc.dll","KBDUS.DLL","twinapi.dll","devobj.dll","biwinrt.dll","capauthz.dll","ExecModelClient.dll","rsaenh.dll","omadmapi.dll","setupapi.dll","Windows.Storage.Search.dll","d3d10warp.dll","sechost.dll","fastprox.dll","nsi.dll","ntasn1.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","atlthunk.dll","ncryptsslp.dll","ntmarta.dll","netutils.dll","OneCoreCommonProxyStub.dll","Windows.ApplicationModel.dll","onnxruntime.dll","StartTileData.dll","rpcrt4.dll","9L1Z74c7.dll","sspicli.dll","powrprof.dll","slc.dll","sppc.dll","mf.dll","apphelp.dll","wbemcomn.dll","userenv.dll","mskeyprotect.dll","msedge_elf.dll","TextInputFramework.dll","AssignedAccessRuntime.dll","mscms.dll","vcruntime140.dll","advapi32.dll","comctl32.dll","coloradapterclient.dll","linkinfo.dll","netprofm.dll","ffmpeg.dll","Windows.Devices.Enumeration.dll","policymanager.dll","ResourcePolicyClient.dll","CryptoWinRT.dll","Windows.UI.dll","propsys.dll","winsta.dll","Windows.UI.Immersive.dll","webauthn.dll","vaultcli.dll","urlmon.dll","user32.dll","msvcp140.dll","crypt32.dll","gpapi.dll","nlaapi.dll","srvcli.dll","dxgi.dll","tbs.dll","Geolocation.dll","msvcp110_win.dll","AppXDeploymentClient.dll","Windows.Internal.Shell.Broker.dll","ws2_32.dll","fltLib.dll","gdi32full.dll","rasadhlp.dll","schannel.dll","dcomp.dll","microsoft_shell_integration.dll","ucrtbase.dll","win32u.dll","vcruntime140_1.dll","winhttp.dll","wbemprox.dll","msctf.dll","usermgrcli.dll","aadWamExtension.dll","cryptsp.dll","bcrypt.dll","version.dll","SHCore.dll","CoreUIComponents.dll","OneCoreUAPCommonProxyStub.dll","edputil.dll","Windows.System.Profile.RetailInfo.dll","amsi.dll","twinapi.appcore.dll","Windows.Security.Authentication.Web.Core.dll","rmclient.dll","DXCore.dll","combase.dll","cfgmgr32.dll","Windows.Web.dll","d3dcompiler_47.dll","TileDataRepository.dll","OnDemandConnRouteHelper.dll","ncrypt.dll","Windows.StateRepositoryPS.dll","imagehlp.dll","ncryptprov.dll","VxSSL64.dll","gdi32.dll","FWPUCLNT.DLL","oleacc.dll","domain_actions.dll","npmproxy.dll","wpnapps.dll","RTWorkQ.dll","InputHost.dll","wintrust.dll","Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll","xmllite.dll","libEGL.dll","wscapi.dll","ole32.dll","profapi.dll","wtsapi32.dll","Windows.Internal.UI.Shell.WindowTabManager.dll","libGLESv2.dll","IPHLPAPI.DLL","DataExchange.dll","fwbase.dll","LocationFrameworkPS.dll","netapi32.dll","PCPKsp.dll","BCP47Langs.dll","shlwapi.dll","clbcatq.dll","WindowManagementAPI.dll","dwmapi.dll","Windows.Networking.Connectivity.dll","msvcp_win.dll","msvcrt.dll","FirewallAPI.dll","UserMgrProxy.dll","DWrite.dll","oneds.dll","sxs.dll","execmodelproxy.dll","mswsock.dll","dpapi.dll","umpdc.dll","telclient.dll","directmanipulation.dll","CapabilityAccessManagerClient.dll","wldp.dll","SystemSettings.DataModel.dll","dbghelp.dll","PCShellCommonProxyStub.dll","Windows.Storage.ApplicationData.dll","wininet.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\crashpad_5880_TNDMKQOLVCNZLISB","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.5880.4588.16774401218830349921","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.5880.4588.14258834391055922628","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.5880.4588.14372493332385175276","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.5880.4588.2892731786551891973","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.5880.4588.2437878483911306618","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.5880.8948.13226655590043470812","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.5880.8948.16582554949034820547","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.5880.8948.5716667298920153923","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.5880.8948.11822691903525356262","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.5880.8948.4105068480120286493","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.5880.4588.450236924855296755","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.5880.4588.12069239360253091679","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.5880.8948.15100517783850168385","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.5880.8948.15275799480493274687","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.5880.5108.5704839697171598978","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.5880.4588.2461719698896026434","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"path":"pipe\\LOCAL\\mojo.1624.7700.13798284198957229763","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7828:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"Local\\SM0:7828:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"SM0:7828:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"SM0:7828:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7828:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7828:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5880:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5880:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"Local\\SM0:5880:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"Local\\SM0:5880:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"SM0:5880:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"SM0:5880:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5880:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5880:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"SM0:8148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"Local\\SM0:8148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3616:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"SM0:3616:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"Local\\SM0:3616:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3616:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"SM0:5016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"Local\\SM0:5016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"SM0:1044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\AppContainerNamedObjects\\S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-924012159-129201922\\SM0:6456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\AppContainerNamedObjects\\S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-924012159-129201922\\SM0:1624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8976:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"SM0:8976:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7204:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"SM0:7204:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"SM0:2688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"Local\\SM0:2688:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"Local\\SM0:2688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"SM0:2688:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2688:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2688:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]},{"name":"SM0:724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae72c9b40981c3ea9010fb0"}]}]}},"report_ids":{"sandbox_job_ids":["6ae72c9b40981c3ea9010fb0"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Shellcode.Donut.Marte..Generic Sample f4b5090b1cdb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f4b5090b1cdb…. Malware family: Shellcode.Donut.Marte..Generic. Threat score 100/100. 14/28 AV engines flagged this file. 9 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079"}],["$","meta","4",{"property":"og:title","content":"Malicious Shellcode.Donut.Marte..Generic Sample f4b5090b1cdb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f4b5090b1cdb…. Malware family: Shellcode.Donut.Marte..Generic. Threat score 100/100. 14/28 AV engines flagged this file. 9 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f4b5090b1cdb57c4b5ba6e127f84d52bfee832994880abc981063ff9f007a079"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Shellcode.Donut.Marte..Generic Sample f4b5090b1cdb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f4b5090b1cdb…. Malware family: Shellcode.Donut.Marte..Generic. Threat score 100/100. 14/28 AV engines flagged this file. 9 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4d","11",{}]]