Play interactive tourEdit tour

Windows Analysis Report
https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22

Overview

General Information

Sample URL:	https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22
Analysis ID:	885199
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Multi AV Scanner detection for domain / URL

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Drops PE files

HTML body contains low number of good links

Deletes files inside the Windows folder

HTML title does not match URL

Drops PE files to the windows directory (C:\Windows)

Classification

×

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: https://tpc.googlesyndication.wiki/

Virustotal: Detection: 12%

Perma Link

Phishing

Phishing site detected (based on favicon image match)

Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22

Matcher: Template: microsoft matched with high similarity

HTML body contains low number of good links

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19

HTTP Parser: Number of links: 0

HTML title does not match URL

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19

HTTP Parser: Title: Redirecting does not match URL

META author tag missing

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="author".. found

HTML page is missing a favicon

Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.msn.com	HTTP Parser: No favicon
Source: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.msn.com	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.msn.com	HTTP Parser: No favicon
Source: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.msn.com	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.msn.com	HTTP Parser: No favicon
Source: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.msn.com	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.wiki/	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.wiki/	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.msn.com	HTTP Parser: No favicon
Source: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.msn.com	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.wiki/	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.wiki/	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.wiki/sodar/sodar2.js	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.wiki/sodar/sodar2.js	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.msn.com	HTTP Parser: No favicon
Source: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.msn.com	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.wiki/	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.wiki/	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.wiki/sodar/sodar2.js	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.wiki/sodar/sodar2.js	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=280&pub_id=43801	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs-simple.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.msn.com	HTTP Parser: No favicon
Source: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=https%3A%2F%2Fwww.msn.com	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://www.msn.com/en-us/money/companies/suncor-s-colorado-refinery-may-experience-greater-air-pollution-incidents-than-comparable-refineries-epa-report/ar-AA1clvWB?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://acdn.adnxs.com/dmp/async_usersync.html	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.wiki/	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.wiki/	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.wiki/sodar/sodar2.js	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.wiki/sodar/sodar2.js	HTTP Parser: No favicon

META copyright tag missing

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d7b530a4-7680-4c23-a8bf-c52c121d2e87&scope=User.Read%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Fwww.msn.com%2Fstaticsb%2Fstatics%2Flatest%2Fauth%2Fauth-redirect-blank.html&client-request-id=fd982ab3-6160-4631-95b0-96363cd22144&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=2.24.0&client_info=1&code_challenge=J8iPCSIqTZHVaD5a1CW0d9DLd401WNduR0sAunVlJEw&code_challenge_method=S256&prompt=none&nonce=9beb7167-8d07-4aa4-be7f-9fab399b71fb&state=eyJpZCI6ImJmN2VkMDU3LWEyNGEtNDU4YS1hZGEwLWNkNjY0ZWVjZjhkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19	HTTP Parser: No <meta name="copyright".. found

Compliance

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Software Vulnerabilities

Allocates a big amount of memory (probably used for heap spraying)

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 43MB

System Summary

Deletes files inside the Windows folder

Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe

File deleted: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpengine.dll

Creates temporary files

Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe

File created: C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35

Reads software policies

Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Classification label

Source: classification engine

Classification label: mal56.phis.win@47/6@0/604

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.msn.com/en-us/sports/nba/breaking-denver-nuggets-reportedly-make-a-trade-before-game-4/ar-AA1cllsb?rc=1&ocid=winp1taskbar&cvid=d0b00654e40a48619dffeac9949448a1&ei=22
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2020,i,3750772093487563994,8545109481708380089,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe "C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-3a8977d1.exe" /q WD
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5128 --field-trial-handle=2020,i,3750772093487563994,8545109481708380089,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2020,i,3750772093487563994,8545109481708380089,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5128 --field-trial-handle=2020,i,3750772093487563994,8545109481708380089,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Process created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe /stub 1.1.18500.10 /payload 1.391.986.0 /program C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-3a8977d1.exe /q WD
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Process created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe /stub 1.1.18500.10 /payload 1.391.986.0 /program C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\mpam-3a8977d1.exe /q WD
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Persistence and Installation Behavior

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpasbase.vdm			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpasdlta.vdm			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpavbase.vdm			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpavdlta.vdm			Jump to dropped file

Drops PE files

Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpengine.dll			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpasdlta.vdm			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpavbase.vdm			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpavdlta.vdm			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpasbase.vdm			Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpengine.dll			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpasdlta.vdm			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpavbase.vdm			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpavdlta.vdm			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	File created: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpasbase.vdm			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Disables application error messsages (SetErrorMode)

Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\MpSigStub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found dropped PE file which has not been started or loaded

Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpengine.dll			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpasdlta.vdm			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpavbase.vdm			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpavdlta.vdm			Jump to dropped file
Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe	Dropped PE file which has not been started: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\3CCC60C5-F5B6-4D04-BFB0-609A9F852D35\mpasbase.vdm			Jump to dropped file

Queries a list of all running processes

Source: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\mpam-3a8977d1.exe

Process information queried: ProcessInformation