Loading ...

Play interactive tourEdit tour

Windows Analysis Report eLVzfyydCC.exe

Overview

General Information

Sample Name:eLVzfyydCC.exe
Analysis ID:551536
MD5:f5b2750348fc459bb7da5c62d9e78959
SHA1:4d16ea637bf1c62716ad0905b07661e78d1908fd
SHA256:1d01909e17918dfcf1f39c280bb67b0b0a36f10163f021944df87c657b56f7f5
Tags:exeGozi
Infos:

Most interesting Screenshot:

Detection

Ursnif
Score:92
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected Ursnif
Antivirus / Scanner detection for submitted sample
Writes or reads registry keys via WMI
Machine Learning detection for sample
Writes registry values via WMI
Uses 32bit PE files
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
IP address seen in connection with other malware
Found evasive API chain checking for process token information
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

  • System is w10x64
  • eLVzfyydCC.exe (PID: 5504 cmdline: "C:\Users\user\Desktop\eLVzfyydCC.exe" MD5: F5B2750348FC459BB7DA5C62D9E78959)
  • iexplore.exe (PID: 6240 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)
    • iexplore.exe (PID: 6292 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6240 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
  • iexplore.exe (PID: 3456 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)
    • iexplore.exe (PID: 1860 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3456 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
  • iexplore.exe (PID: 4988 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)
    • iexplore.exe (PID: 6528 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4988 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
  • cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "VmXgLFsGtmpv5UFNqOMKfr0bQb92JPtdvvowHDJjkcSsK9jcUZlaQ6iXE5japhvoxPqRWk5IIJokHayTapPtkCdY5JrUtPvVruWyRldgR+UJRy2GqJO+i8zXukuoTAdIlrIhEsilDaGjhfbpVdibfm3BDbnXusiwcmim77qYOtpDP+xBzaY0x5xORvjah7KauUIP6BwsfyuU7cJTiQJuQytCX1etYoLxXBskIQZpZQuCKWsabk1OCSSGG5ZJYp0JNAkJTc2w/nTKxLw/R7FbsSOd0CoOEEW09MMqIq2i2gHlnpZPuc59tliqYm3utpZ/+G04rfEyu/NJgHipl21RpkWtrb9lsCeKXtEhKFh5p+0=", "c2_domain": ["update.kaspersky.com", "plunger.in", "update.fortinet.com", "blancs.ws", "piepes.in", "csite.ws"], "botnet": "2001", "server": "50", "serpent_key": "3FBmeOqlY71WmiXZ", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000003.343095764.00000000014C8000.00000004.00000040.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
    00000000.00000002.511051320.00000000014C8000.00000004.00000040.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
      00000000.00000003.343140819.00000000014C8000.00000004.00000040.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
        00000000.00000003.343072067.00000000014C8000.00000004.00000040.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
          00000000.00000003.343156209.00000000014C8000.00000004.00000040.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
            Click to see the 5 entries

            Sigma Overview

            No Sigma rule has matched

            Jbx Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection:

            barindex
            Found malware configurationShow sources
            Source: eLVzfyydCC.exeMalware Configuration Extractor: Ursnif {"RSA Public Key": "VmXgLFsGtmpv5UFNqOMKfr0bQb92JPtdvvowHDJjkcSsK9jcUZlaQ6iXE5japhvoxPqRWk5IIJokHayTapPtkCdY5JrUtPvVruWyRldgR+UJRy2GqJO+i8zXukuoTAdIlrIhEsilDaGjhfbpVdibfm3BDbnXusiwcmim77qYOtpDP+xBzaY0x5xORvjah7KauUIP6BwsfyuU7cJTiQJuQytCX1etYoLxXBskIQZpZQuCKWsabk1OCSSGG5ZJYp0JNAkJTc2w/nTKxLw/R7FbsSOd0CoOEEW09MMqIq2i2gHlnpZPuc59tliqYm3utpZ/+G04rfEyu/NJgHipl21RpkWtrb9lsCeKXtEhKFh5p+0=", "c2_domain": ["update.kaspersky.com", "plunger.in", "update.fortinet.com", "blancs.ws", "piepes.in", "csite.ws"], "botnet": "2001", "server": "50", "serpent_key": "3FBmeOqlY71WmiXZ", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}
            Multi AV Scanner detection for submitted fileShow sources
            Source: eLVzfyydCC.exeReversingLabs: Detection: 46%
            Antivirus / Scanner detection for submitted sampleShow sources
            Source: eLVzfyydCC.exeAvira: detected
            Machine Learning detection for sampleShow sources
            Source: eLVzfyydCC.exeJoe Sandbox ML: detected
            Source: 0.0.eLVzfyydCC.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
            Source: 0.2.eLVzfyydCC.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
            Source: C:\Users\user\Desktop\eLVzfyydCC.exeCode function: 0_2_00574872 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,CryptDecrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,0_2_00574872
            Source: eLVzfyydCC.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeFile opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dllJump to behavior
            Source: unknownHTTPS traffic detected: 77.74.178.40:443 -> 192.168.2.5:49760 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 185.85.15.47:443 -> 192.168.2.5:49769 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 185.85.15.47:443 -> 192.168.2.5:49768 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 216.58.212.136:443 -> 192.168.2.5:49776 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 216.58.212.136:443 -> 192.168.2.5:49777 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 93.159.228.11:443 -> 192.168.2.5:49800 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 93.159.228.11:443 -> 192.168.2.5:49801 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 52.211.244.253:443 -> 192.168.2.5:49837 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 52.211.244.253:443 -> 192.168.2.5:49836 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 13.36.218.177:443 -> 192.168.2.5:49843 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 13.36.218.177:443 -> 192.168.2.5:49842 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 52.16.52.14:443 -> 192.168.2.5:49839 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 52.16.52.14:443 -> 192.168.2.5:49838 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.5:49844 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.5:49845 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 185.85.15.46:443 -> 192.168.2.5:49847 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 185.85.15.46:443 -> 192.168.2.5:49846 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.126.175:443 -> 192.168.2.5:49855 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.16.126.175:443 -> 192.168.2.5:49854 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 13.226.159.97:443 -> 192.168.2.5:49856 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 13.226.159.97:443 -> 192.168.2.5:49857 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 18.192.164.101:443 -> 192.168.2.5:49852 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 18.192.164.101:443 -> 192.168.2.5:49853 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 34.102.147.248:443 -> 192.168.2.5:49869 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 34.102.147.248:443 -> 192.168.2.5:49868 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 13.226.159.34:443 -> 192.168.2.5:49866 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 13.226.159.34:443 -> 192.168.2.5:49870 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 35.186.249.72:443 -> 192.168.2.5:49873 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 35.186.249.72:443 -> 192.168.2.5:49874 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 54.228.170.24:443 -> 192.168.2.5:49872 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 54.228.170.24:443 -> 192.168.2.5:49871 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.18.12.5:443 -> 192.168.2.5:49876 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 104.18.12.5:443 -> 192.168.2.5:49875 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 157.240.17.15:443 -> 192.168.2.5:49878 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 157.240.17.15:443 -> 192.168.2.5:49877 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 108.177.15.157:443 -> 192.168.2.5:49879 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 108.177.15.157:443 -> 192.168.2.5:49880 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 54.195.126.67:443 -> 192.168.2.5:49882 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 54.195.126.67:443 -> 192.168.2.5:49883 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.185.195:443 -> 192.168.2.5:49887 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.186.36:443 -> 192.168.2.5:49889 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.185.195:443 -> 192.168.2.5:49886 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.186.36:443 -> 192.168.2.5:49888 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 64.70.19.170:443 -> 192.168.2.5:49936 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 64.70.19.170:443 -> 192.168.2.5:49937 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.186.36:443 -> 192.168.2.5:49966 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.186.36:443 -> 192.168.2.5:49967 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 216.58.212.136:443 -> 192.168.2.5:49975 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 216.58.212.136:443 -> 192.168.2.5:49976 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.5:49979 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.5:49978 version: TLS 1.2

            Networking:

            barindex
            Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
            Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49756 -> 185.85.15.26:80
            Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49934 -> 64.70.19.203:80
            Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49934 -> 64.70.19.203:80
            Source: Joe Sandbox ViewJA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c
            Source: Joe Sandbox ViewIP Address: 13.36.218.177 13.36.218.177
            Source: Joe Sandbox ViewIP Address: 64.70.19.203 64.70.19.203
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49986
            Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49985
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49861
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49860
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49981
            Source: unknownNetwork traffic detected: HTTP traffic on port 49949 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49980
            Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49875 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49961 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49990 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49859
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49858
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49979
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49857
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49978
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49856
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49977
            Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49855
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49976
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49975
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49853
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49974
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
            Source: unknownNetwork traffic detected: HTTP traffic on port 49950 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49973
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49972
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49971
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49970
            Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49858 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49967 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49943 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
            Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49848
            Source: unknownNetwork traffic detected: HTTP traffic on port 49978 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
            Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49846
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49967
            Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49845
            Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49966
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49844
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49965
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49964
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49842
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49963
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49962
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49961
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49960
            Source: unknownNetwork traffic detected: HTTP traffic on port 49972 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49966 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49989 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49839
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49838
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49959
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49837
            Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49958
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49957
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49956
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49955
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
            Source: unknownNetwork traffic detected: HTTP traffic on port 49887 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49954
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49953
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49952
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49951
            Source: unknownNetwork traffic detected: HTTP traffic on port 49839 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49950
            Source: unknownNetwork traffic detected: HTTP traffic on port 49944 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49870 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49853 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49938 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49955 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
            Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49949
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49948
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49947
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49946
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49945
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49944
            Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49943
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
            Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49945 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
            Source: unknownNetwork traffic detected: HTTP traffic on port 49951 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
            Source: unknownNetwork traffic detected: HTTP traffic on port 49974 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
            Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49939 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49980 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49845 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49868 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
            Source: unknownNetwork traffic detected: HTTP traffic on port 49885 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
            Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49879 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49985 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49957 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49991 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49889
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49888
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49887
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49886
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49885
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49884
            Source: unknownNetwork traffic detected: HTTP traffic on port 49995 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49883
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49882
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49880
            Source: unknownNetwork traffic detected: HTTP traffic on port 49857 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49940 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49956 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49979 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49879
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49878
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49877
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49876
            Source: unknownNetwork traffic detected: HTTP traffic on port 49973 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49875
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49874
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49995
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49873
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49994
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49872
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49993
            Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49871
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49992
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49870
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49991
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49990
            Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49874 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49880 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49962 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49846 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49869
            Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49868
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49989
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49866
            Source: unknownNetwork traffic detected: HTTP traffic on port 49970 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49878 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49958 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49889 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49866 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49837 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49975 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49946 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49872 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49855 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49964 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49981 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49861 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49844 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49947 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49873 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49986 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49963 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49992 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
            Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
            Source: unknownNetwork traffic detected: HTTP traffic on port 49952 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49994 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
            Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
            Source: unknownNetwork traffic detected: HTTP traffic on port 49856 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49884 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49941 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49867 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49942
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
            Source: unknownNetwork traffic detected: HTTP traffic on port 49842 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49941
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49940
            Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49859 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49871 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49965 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49939
            Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49938
            Source: unknownNetwork traffic detected: HTTP traffic on port 49942 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49937
            Source: unknownNetwork traffic detected: HTTP traffic on port 49977 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49936
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
            Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49954 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49971 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49936 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49876 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49960 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
            Source: unknownNetwork traffic detected: HTTP traffic on port 49848 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49882 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
            Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
            Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49838 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49976 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49953 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49877 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49854 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49937 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49860 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49883 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49948 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49959 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49993 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49888 -> 443
            Source: fbevents[1].js.8.drString found in binary or memory: (function(a,b,c,d){var e={exports:{}};e.exports;(function(){var f=a.fbq;f.execStart=a.performance&&a.performance.now&&a.performance.now();if(!function(){var b=a.postMessage||function(){};if(!f){b({action:"FB_LOG",logType:"Facebook Pixel Error",logMessage:"Pixel code is not installed correctly on this page"},"*");"error"in console&&console.error("Facebook Pixel Error: Pixel code is not installed correctly on this page");return!1}return!0}())return;f.__fbeventsModules||(f.__fbeventsModules={},f.__fbeventsResolvedModules={},f.getFbeventsModules=function(a){f.__fbeventsResolvedModules[a]||(f.__fbeventsResolvedModules[a]=f.__fbeventsModules[a]());return f.__fbeventsResolvedModules[a]},f.fbIsModuleLoaded=function(a){return!!f.__fbeventsModules[a]},f.ensureModuleRegistered=function(b,a){f.fbIsModuleLoaded(b)||(f.__fbeventsModules[b]=a)});f.ensureModuleRegistered("signalsFBEventsGetIwlUrl",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=f.getFbeventsModules("signalsFBEventsGetTier");e.exports=function(b,c){c=a(c);c=c==null?"www.facebook.com":"www."+c+".facebook.com";return"https://"+c+"/signals/iwl.js?pixel_id="+b}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsGetTier",function(){return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEvents.plugins.iwlbootstrapper",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var c=f.getFbeventsModules("SignalsFBEventsIWLBootStrapEvent"),d=f.getFbeventsModules("SignalsFBEventsLogging"),g=f.getFbeventsModules("SignalsFBEventsNetworkConfig"),h=f.getFbeventsModules("SignalsFBEventsPlugin"),i=f.getFbeventsModules("signalsFBEventsGetIwlUrl"),j=f.getFbeventsModules("signalsFBEventsGetTier"),k=d.logUserError,l=/^https:\/\/.*\.facebook\.com$/i,m="FACEBOOK_IWL_CONFIG_STORAGE_KEY",n=a.sessionStorage?a.sessionStorage:{getItem:function(a){return null},removeItem:function(a){},setItem:function(a,b){}};e.exports=new h(function(d,e){function h(c,d){var e=b.createElement("script");e.async=!0;e.onload=function(){if(!a.FacebookIWL||!a.FacebookIWL.init)return;var b=j(g.ENDPOINT);b!=null&&a.FacebookIWL.set&&a.FacebookIWL.set("tier",b);d()};a.FacebookIWLSessionEnd=function(){n.removeItem(m),a.close()};e.src=i(c,g.ENDPOINT);b.body&&b.body.appendChild(e)}var o=!1,p=function(a){return!!(e&&e.pixelsByID&&Object.prototype.hasOwnProperty.call(e.pixelsByID,a))};function q(){if(o)return;var b=n.getItem(m);if(!b)return;b=JSON.parse(b);var c=b.pixelID,d=b.graphToken,e=b.sessionStartTime;o=!0;h(c,function(){var b=p(c)?c:null;a.FacebookIWL.init(b,d,e)})}function r(b){if(o)return;h(b,func
            Source: msapplication.xml0.7.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xe4d2460c,0x01d807dd</date><accdate>0xe4f14465,0x01d807dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
            Source: msapplication.xml5.7.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xe63f119a,0x01d807dd</date><accdate>0xe694e212,0x01d807dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
            Source: msapplication.xml7.7.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xe6fdca6f,0x01d807dd</date><accdate>0xe71cc945,0x01d807dd</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
            Source: gtm[1].js0.8.dr, js[3].js.8.drString found in binary or memory: E=W("YT"),D=function(){e(C)};I(q.vtp_gtmOnSuccess);if(E)E.ready&&E.ready(D);else{var F=W("onYouTubeIframeAPIReady");xt("onYouTubeIframeAPIReady",function(){F&&F();D()});I(function(){for(var S=W("document"),M=S.getElementsByTagName("script"),J=M.length,K=0;K<J;K++){var Q=M[K].getAttribute("src");if(b(Q,"iframe_api")||b(Q,"player_api"))return}for(var N=S.getElementsByTagName("iframe"),V=N.length,aa=0;aa<V;aa++)if(!t&&c(N[aa],C.rb)){U("https://www.youtube.com/iframe_api");t=!0;break}})}}else I(q.vtp_gtmOnSuccess)} equals www.youtube.com (Youtube)
            Source: gtm[1].js.8.dr, gtm[1].js0.8.dr, js[3].js.8.drString found in binary or memory: function qv(a,b){}function rv(a,b,c){};var sv=["www.youtube.com","www.youtube-nocookie.com"],tv,uv=!1,vv=0; equals www.youtube.com (Youtube)
            Source: gtm[1].js.8.dr, gtm[1].js0.8.dr, js[3].js.8.drString found in binary or memory: var Iw=function(a,b){return b};var Yb=ca(["data-gtm-yt-inspected-"]),Jw=["www.youtube.com","www.youtube-nocookie.com"],Kw,Lw=!1; equals www.youtube.com (Youtube)
            Source: gtm[1].js0.8.dr, js[3].js.8.drString found in binary or memory: var p=["www.youtube.com","www.youtube-nocookie.com"],r={UNSTARTED:-1,ENDED:0,PLAYING:1,PAUSED:2,BUFFERING:3,CUED:5},u,t=!1;(function(q){Z.__ytl=q;Z.__ytl.m="ytl";Z.__ytl.isVendorTemplate=!0;Z.__ytl.priorityOverride=0})(function(q){q.vtp_triggerStartOption?n(q):lm(function(){n(q)})})}(); equals www.youtube.com (Youtube)
            Source: wc_landing[1].htm.27.drString found in binary or memory: http://blancs.ws
            Source: ~DF5FB64BEAADE76AFF.TMP.26.dr, {39E1AB7A-73D1-11EC-90E5-ECF4BB570DC9}.dat.26.drString found in binary or memory: http://blancs.ws/drew/SVohbxNR_2FyCYmenSW7CXy/mnUNl0_2BA/r7aNUwhQrLgjTBURN/to2yS6Hh74Jd/I8HRX9nlHVK/
            Source: imagestore.dat.8.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
            Source: {293D228C-73D1-11EC-90E5-ECF4BB570DC9}.dat.23.dr, ~DF18CD11B8A0C5DC0C.TMP.23.drString found in binary or memory: http://update.fortinet.com/drew/Bd1T9k4DekRs4gmX6OdkU/C5XR7mudVSICYH_2/B89CqXj2t_2F1GO/T5QYfvi5_2Fi7
            Source: msapplication.xml.7.drString found in binary or memory: http://www.amazon.com/
            Source: msapplication.xml1.7.drString found in binary or memory: http://www.google.com/
            Source: wc_landing[1].htm.27.drString found in binary or memory: http://www.icann.org/en/registrars/registrant-rights-responsibilities-en.htm
            Source: wc_landing[1].htm.27.drString found in binary or memory: http://www.icann.org/en/udrp/udrp.htm
            Source: msapplication.xml2.7.drString found in binary or memory: http://www.live.com/
            Source: msapplication.xml3.7.drString found in binary or memory: http://www.nytimes.com/
            Source: msapplication.xml4.7.drString found in binary or memory: http://www.reddit.com/
            Source: msapplication.xml5.7.drString found in binary or memory: http://www.twitter.com/
            Source: msapplication.xml6.7.drString found in binary or memory: http://www.wikipedia.com/
            Source: msapplication.xml7.7.drString found in binary or memory: http://www.youtube.com/
            Source: js[2].js.8.dr, gtm[1].js0.8.drString found in binary or memory: https://ade.googlesyndication.com/ddm/activity
            Source: js[2].js.8.dr, gtm[1].js0.8.drString found in binary or memory: https://adservice.google.com/pagead/regclk
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://africa.kaspersky.com/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://afrique.kaspersky.com/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://algerie.kaspersky.com/
            Source: analytics[2].js.8.drString found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
            Source: js[3].js.8.drString found in binary or memory: https://analytics.google.com/g/collect
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://app.appsflyer.com/com.kms.free
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://app.appsflyer.com/com.kms.free?pid=klsite
            Source: js[2].js.8.dr, gtm[1].js.8.dr, gtm[1].js0.8.dr, js[3].js.8.drString found in binary or memory: https://cct.google/taggy/agent.js
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://companyaccount.kaspersky.com/account/login
            Source: gtm[1].js.8.drString found in binary or memory: https://consent.cookiebot.com/uc.js?cbid=
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://content.kaspersky-labs.com/se/ca/content/en-ca/images/baseline/homepage/merch-cards/kts-card
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://content.kaspersky-labs.com/se/com/content/en-global/images/baseline/masthead-home/business-a
            Source: gtm[1].js.8.dr, gtm[1].js0.8.drString found in binary or memory: https://github.com/krux/postscribe/blob/master/LICENSE.
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://help.kaspersky.com/Legal/Security-Cloud/en-US/KSCRegions.htm
            Source: s_code_single_suite[1].js.8.drString found in binary or memory: https://kaspersky-mkt-prod1-m.adobe-campaign.com
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://latam.kaspersky.com/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://me-en.kaspersky.com/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://me.kaspersky.com/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://my.kaspersky.com/
            Source: js[2].js.8.dr, gtm[1].js0.8.drString found in binary or memory: https://pagead2.googlesyndication.com
            Source: gtm[1].js0.8.drString found in binary or memory: https://pagead2.googlesyndication.com/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://partnersearch.kaspersky.com/?b2b
            Source: insight.min[1].js.8.drString found in binary or memory: https://px.ads.linkedin.com/collect?
            Source: insight.min[1].js.8.drString found in binary or memory: https://px.ads.linkedin.com/insight_tag_errors.gif?
            Source: gtm[1].js0.8.drString found in binary or memory: https://s.kk-resources.com/ks.js
            Source: gtm[1].js0.8.drString found in binary or memory: https://s.kk-resources.com/kst.js
            Source: gtm[1].js0.8.drString found in binary or memory: https://s.kk-resources.com/leadtag.js
            Source: gtm[1].js0.8.drString found in binary or memory: https://smct.co/tm/?t=
            Source: gtm[1].js0.8.drString found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.min.js
            Source: js[3].js.8.drString found in binary or memory: https://stats.g.doubleclick.net/g/collect
            Source: js[3].js.8.drString found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
            Source: analytics[2].js.8.drString found in binary or memory: https://stats.g.doubleclick.net/j/collect
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://store.kaspersky.com/store/kasperuk/en_GB/DisplayCustomerServiceOrderSearchPage
            Source: analytics[2].js.8.drString found in binary or memory: https://tagassistant.google.com/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://usa.kaspersky.com/?ignoreredirects=true
            Source: gtm[1].js.8.drString found in binary or memory: https://www.awin1.com/sread.img?tt=ns&tv=2&
            Source: gtm[1].js.8.drString found in binary or memory: https://www.dwin1.com/
            Source: gtm[1].js.8.drString found in binary or memory: https://www.google-analytics.com/analytics.js
            Source: analytics[2].js.8.drString found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
            Source: js[3].js.8.drString found in binary or memory: https://www.google-analytics.com/g/collect
            Source: analytics[2].js.8.drString found in binary or memory: https://www.google-analytics.com/gtm/js?id=
            Source: analytics[2].js.8.drString found in binary or memory: https://www.google.%/ads/ga-audiences
            Source: js[2].js.8.dr, gtm[1].js0.8.drString found in binary or memory: https://www.google.com
            Source: analytics[2].js.8.drString found in binary or memory: https://www.google.com/ads/ga-audiences
            Source: imagestore.dat.8.drString found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
            Source: gtm[1].js0.8.drString found in binary or memory: https://www.google.com/pagead/conversion_async.js
            Source: js[2].js.8.dr, gtm[1].js.8.dr, gtm[1].js0.8.dr, js[3].js.8.drString found in binary or memory: https://www.googletagmanager.com/a?id=
            Source: analytics[2].js.8.drString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
            Source: wc_landing[1].htm.27.drString found in binary or memory: https://www.icann.org/resources/pages/transfer-policy-2015-09-24-en
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.be/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.bg/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.ca/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.co.in/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.co.jp/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.co.kr/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.co.th/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.co.uk/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.co.za/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com.au/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com.br/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com.cn/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com.hk/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com.tr/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com.tw/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com.vn/
            Source: ~DF2B88529D39626A07.TMP.7.dr, {FBB47D09-73D0-11EC-90E5-ECF4BB570DC9}.dat.7.drString found in binary or memory: https://www.kaspersky.com/?domain=update.kaspersky.com
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com/about/press-releases/2021_kaspersky-recognized-as-a-2021-gartner-peer-insi
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com/content/en-global/images/baseline/masthead-home/MRG_Effitas.png
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com/content/en-global/images/baseline/masthead-home/av-2020.png
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com/content/en-global/images/baseline/masthead-home/business-award-1.png
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com/content/en-global/images/baseline/masthead-home/business-award-2.png
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com/content/en-global/images/baseline/masthead-home/business-award-3.png
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com/content/en-global/images/baseline/masthead-home/home-award-3.png
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com/content/en-global/images/baseline/masthead-home/home-award-4.png
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com/content/en-global/images/baseline/masthead-home/home-award-5.png
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com/content/en-global/images/baseline/masthead-home/home-mobile.png
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com/content/en-global/images/baseline/masthead-home/home-tablet.png
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com/content/en-global/images/baseline/masthead-home/home.png
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.com/content/en-global/images/baseline/merch-cards/kis-card.png
            Source: imagestore.dat.8.drString found in binary or memory: https://www.kaspersky.com/favicon.ico~
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.cz/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.de/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.dk/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.es/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.fi/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.fr/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.gr/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.hu/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.it/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.ma/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.nl/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.no/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.pl/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.pt/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.ro/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.rs/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.ru?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.se/?ignoreredirects=true
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.tn/
            Source: HET0OTHY.htm.8.drString found in binary or memory: https://www.kaspersky.ua/
            Source: 6i[1].htm.27.drString found in binary or memory: https://www.website.ws/wc_landing.dhtml?domain=blancs.ws
            Source: gtm[1].js0.8.dr, js[3].js.8.drString found in binary or memory: https://www.youtube.com/iframe_api
            Source: unknownHTTP traffic detected: POST /j/collect?v=1&_v=j96&a=2133978934&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.kaspersky.com%2F%3Fdomain%3Dupdate.kaspersky.com&dp=%2F%3Fdomain%3Dupdate.kaspersky.com&ul=en-us&de=utf-8&dt=Kaspersky%20Cyber%20Security%20Solutions%20for%20Home%20%26%20Business%20%7C%20Kaspersky&sd=24-bit&sr=1280x1024&vp=767x554&je=1&fl=29.0%20r0&ec=Timer&ea=15sec&_u=YEBAAEQAAAAAAC~&jid=27385254&gjid=1869784295&cid=388491555.1642010231&uid=19200230165318792082030216481562829755&tid=UA-63997723-2&_gid=1932271643.1642010231&_r=1&gtm=2wg1a0WZ7LJ3&z=673975022 HTTP/1.1Accept: */*Content-Type: text/plainReferer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USOrigin: https://www.kaspersky.comAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.google-analytics.comContent-Length: 0Connection: Keep-AliveCache-Control: no-cache
            Source: unknownDNS traffic detected: queries for: update.kaspersky.com
            Source: global trafficHTTP traffic detected: GET /?domain=update.kaspersky.com HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateConnection: Keep-AliveHost: www.kaspersky.com
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/css/d065abc22e2b68eda666.css HTTP/1.1Accept: text/css, */*Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/css/9b428f5ec98113084430.css HTTP/1.1Accept: text/css, */*Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/css/a9ed3a1594363c6938f8.css HTTP/1.1Accept: text/css, */*Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/css/c5c20187bc88132abb4a.css HTTP/1.1Accept: text/css, */*Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/css/d4badb8db511cd24e95e.css HTTP/1.1Accept: text/css, */*Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /se/com/content/en-global/images/baseline/masthead-home/business-award-4/business-award-4.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: content.kaspersky-labs.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /se/ca/content/en-ca/images/baseline/homepage/merch-cards/kts-card/kts-card.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: content.kaspersky-labs.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/css/bfdf68743177ecbb5a22.css HTTP/1.1Accept: text/css, */*Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/css/2b763e44c355fc014556.css HTTP/1.1Accept: text/css, */*Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/css/2de41e69d7c1a5e11097.css HTTP/1.1Accept: text/css, */*Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/css/730c637540e857733f76.css HTTP/1.1Accept: text/css, */*Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /gtm.js?id=GTM-WZ7LJ3 HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.googletagmanager.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/css/c5412e1b22c148871c80.css HTTP/1.1Accept: text/css, */*Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/css/dc64fc9dfc4c6e33bad5.css HTTP/1.1Accept: text/css, */*Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/css/fe5b2601695152ff1fad.css HTTP/1.1Accept: text/css, */*Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /content/en-global/images/baseline/masthead-home/home-mobile.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /content/en-global/images/baseline/masthead-home/home.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /content/en-global/images/baseline/masthead-home/av-2020.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /content/en-global/images/baseline/masthead-home/MRG_Effitas.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /content/en-global/images/baseline/masthead-home/home-award-4.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /content/en-global/images/baseline/masthead-home/home-award-5.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /content/en-global/images/baseline/masthead-home/business-award-3.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /content/en-global/images/baseline/masthead-home/home-award-3.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /content/en-global/images/baseline/merch-cards/kis-card.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /content/en-global/images/baseline/masthead-home/business-award-2.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /content/en-global/images/baseline/masthead-home/business-award-1.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /content/en-global/images/baseline/body-image/kaspersky-ransomware-test-dark.jpg HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /content/en-global/images/baseline/merch-cards/optimum-security-card.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /content/en-global/images/baseline/merch-cards/ksos-card.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/images/assets/map.png HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=7090d509a01883900b145f8168e6ad09; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/runtime/polyfills-4cd59183e7ac72a5e1c7.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=ee9b9608074f39da6e54644c3b42316e; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/eI2qEMPWp5Vb-YNsYp7i9/pages/_app.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=ee9b9608074f39da6e54644c3b42316e; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/chunks/61.bc1dd900b92bc9d80767.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=ee9b9608074f39da6e54644c3b42316e; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/eI2qEMPWp5Vb-YNsYp7i9/pages/index.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=ee9b9608074f39da6e54644c3b42316e; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/chunks/161.7bb93c182f3aee250b4e.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=ee9b9608074f39da6e54644c3b42316e; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/chunks/112.72680c3d02b12dbcfc70.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=ee9b9608074f39da6e54644c3b42316e; country=CH
            Source: global trafficHTTP traffic detected: GET /tracking/omniture/s_code_single_suite.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: media.kaspersky.comConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/chunks/74.aff6e43f31266e4ba1e4.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.kaspersky.comConnection: Keep-AliveCookie: webserver_id=ee9b9608074f39da6e54644c3b42316e; country=CH
            Source: global trafficHTTP traffic detected: GET /siterenderer/_next/static/chunks/80.2da60d8f88d5016b2bb7.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.kaspersky.com/?domain=update.kaspersky.comAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0;